diff --git a/docs/architecture/rfcs/README.md b/docs/architecture/rfcs/README.md
index 3659227d16..4d61ccc6ee 100644
--- a/docs/architecture/rfcs/README.md
+++ b/docs/architecture/rfcs/README.md
@@ -192,12 +192,13 @@ Paired diffs do not certify translation accuracy.
settlement, and typed Effect Program foundations are shipped. Replan
planning/ACK stays domain-local until a second real lifecycle justifies
extraction.
-- [Controller / Executor Sessions and One Governed Work Contract v0](controller-executor-unified-contract-v0.md)
+- [Router–Controller–Worker Architecture and One Governed Work Contract v0](controller-executor-unified-contract-v0.md)
([中文版](controller-executor-unified-contract-v0.zh-CN.md))
- **Delivery on `main`:** Design only; no unified schema or dual-session profile is implemented.
- **Current boundary:** Replaces permanent quota/Turn packet views with one
- contract including differential context; controller-only model access to
- Core, natural-language executor work and runtime-owned identity/recovery.
+ contract including differential context; a steward router coordinates Agent
+ units, each binding a controller and worker with asynchronous interaction.
+ Existing Core/request/session owners retain authority, identity and recovery.
C1–C9 connect concrete refactors, real host adoption and complete-cost
qualification without changing defaults or launching experiments.
- [TypeScript Control-Plane Migration v0](typescript-control-plane-migration-v0.md)
diff --git a/docs/architecture/rfcs/controller-executor-unified-contract-v0.md b/docs/architecture/rfcs/controller-executor-unified-contract-v0.md
index 0bbff0aa14..4be416809b 100644
--- a/docs/architecture/rfcs/controller-executor-unified-contract-v0.md
+++ b/docs/architecture/rfcs/controller-executor-unified-contract-v0.md
@@ -1,24 +1,65 @@
-# RFC: Controller / Executor Sessions and One Governed Work Contract (v0)
+# RFC: Router–Controller–Worker Architecture and One Governed Work Contract (v0)
-- **RFC status:** Accepted (design acceptance takes effect on merge)
+
+
+- **RFC status:** Existing design accepted; router / binding-unit extension proposed
- **Supersedes / closes:** none
- **Delivery maturity:** Proposal; no new runtime, schema or default is shipped by this document.
- **Authors / owners:** LoopX maintainers; control-plane and runtime owners
- **Created:** 2026-10-27
-- **Last normative revision:** 2026-11-02
-- **Implementation baseline:** `fe2b8dcbcb998647edb4bafb51932988bd7fdaa6`
+- **Last normative revision:** 2026-11-06
+- **Latest source audit:** `f91e26d91d3e4e1b28b69f5881a059ea78891082`; historical experiments retain their own baselines.
- **Related contracts:** [Effect interpreter](agent-loop-effect-interpreter-v0.md), [Session execution modes](agent-session-execution-modes-v0.md), [Semantic handoff](capable-manager-semantic-handoff-v0.md), [Overall roadmap](loopx-overall-roadmap-v0.md)
- **Language mirror:** [中文版](controller-executor-unified-contract-v0.zh-CN.md)
## Document map and maintenance contract
-The English and Chinese documents are semantic mirrors; a difference is a defect.
+**Target experience: a steward routes several Agents; each Agent continuously
+closes the controller–worker loop of work selection, execution, evidence assessment
+and feedback. Users can converse, correct and stop during that loop, and results
+return along the original request.**
+This is a long-horizon architecture choice to qualify, not a claim of universal
+best practice.
+
+
+
+```mermaid
+flowchart TB
+ U[User: App / Lark / CLI] <--> R[Router: steward conversation]
+ R <-->|Scoped request / return| C1
+ R <-->|Scoped request / return| C2
+ U <-.->|Direct interaction, same request and audience rules| C1
+ subgraph A[Agent A: one binding unit]
+ C1[Controller: plan, interact, assess]
+ W1[Worker / Executor: execute, artifacts, evidence]
+ C1 <-->|Task / correction / findings| W1
+ end
+ subgraph B[Agent B: another binding unit]
+ C2[Controller]
+ W2[Worker / Executor]
+ C2 <--> W2
+ end
+ R <-->|Typed route / request operations| K[Existing Core owners and selected AuthorityStore]
+ C1 <-->|Work admission / original settlement| K
+ C2 <--> K
+ W1 --> H1[Scoped Host tools]
+ W2 --> H2[Scoped Host tools]
+```
-Section 4 records source facts at the named baseline. Sections 1–3 and 5–11
-define the proposed decision and acceptance; section 12 records unresolved
-choices. Before merge this is a review proposal. Merge accepts the design,
-not implementation, installation, experiments or default promotion. Historical
-evidence belongs in a dated ledger when an implementation first produces it.
+| Reader question | Entry |
+| --- | --- |
+| Why split these roles, and what is missing? | Sections 1–4 and the [current source audit](#current-delivery-audit) |
+| How do the three layers and one Agent identity fit? | [System diagram](#system-topology), [binding unit](#agent-binding-unit) |
+| What keeps work advancing without another user message? | [Primary execution loop](#controller-worker-main-loop) |
+| How do conversation, Stop and recovery work during execution? | [Asynchronous sequence](#asynchronous-control), [attention / preemption](#controller-attention-and-preemption), [failure isolation](#router-failure-recovery) |
+| What gets delivered, validated and deleted? | [Dependencies and slices](#delivery-path-from-current-state), [product acceptance](#superagent-acceptance), sections 8–11 |
+| Where are C1 field, context, wire and baseline details? | [Technical annex](controller-executor-unified-contract-v0/contract-and-context.md) |
+
+English and Chinese are semantic mirrors. This main document owns current design;
+the annex retains migration detail and dated ledgers retain historical evidence.
+Original section anchors still reach the annex. Design acceptance, source presence,
+packaged/installed qualification and measured benefit are distinct. This RFC creates
+no runtime, changes no default and starts no experiment.
## 1. Decision summary
@@ -31,7 +72,7 @@ evidence belongs in a dated ledger when an implementation first produces it.
against the original quota-packet path. Existing domain owners still decide
their own facts.
2. In the optional two-session profile, the **controller model session is the
- sole model-facing Core client and an intelligent mediator of control work**.
+ unit’s only model client for work control and settlement, and its intelligent mediator**.
It reads the contract, reasons about work,
talks to the executor and submits explicit typed Core operations. Core owns
legal transitions and receipts; the controller is not a second authority.
@@ -48,10 +89,16 @@ evidence belongs in a dated ledger when an implementation first produces it.
5. Unification first qualifies the existing single-session path. Two-session
execution remains opt-in until matched outcome and complete-cost evidence
justifies adoption. This RFC launches no benchmark or privileged operation.
-6. While the executor works, the controller remains available to the user:
- answer questions, proactively explain meaningful changes, present useful
- artifacts and incorporate feedback into subsequent work. Qualify that
- journey through C6/C8; session separation alone does not deliver it.
+6. The controller–worker execution loop is primary: assess ordinary results as
+ well as blockers, give feedback and continue useful admitted work without a
+ new user prompt. While the executor works, the controller also answers users,
+ incorporates corrections and presents useful artifacts. Reporting is a side
+ activity, not the loop's default destination. Qualify both through C6/C8.
+7. Make the steward the **router**: use existing semantic requests to coordinate
+ several controller + worker binding units. Each retains one Agent identity;
+ the router may use authorized request/route operations but cannot settle the
+ receiver's work. Deliver one asynchronous unit before adopting the existing
+ multi-recipient chain.
## 2. Problem and motivation
@@ -96,8 +143,8 @@ controller/executor communication, shared lifecycle reuse, host adapters,
benchmark adoption, retirement and observable product acceptance.
Non-goals: a new Goal store, workflow DSL, generic effect executor, permission
-engine, scheduler, mandatory two-Agent team, automatic host switching or changes
-to benchmark scoring. Peer teams retain existing delegation/acceptance contracts.
+engine, scheduler, mandatory two-session execution, unlimited team hierarchies,
+automatic host switching or changes to benchmark scoring. Peer teams retain existing delegation/acceptance contracts.
This proposal does not move business reasoning into deterministic Core rules.
## 4. Current-system contract
@@ -119,121 +166,408 @@ source, single/two-session organization and evaluation arm are independent
axes. Not every combination is supported. Native/plain benchmark controls may
intentionally have no LoopX Core and must remain uncontaminated controls.
-### C1 source audit: shared owners and the remaining split
+
-Bound native execution preparation retains the ordinary managed claim reference
-and captures its same-Turn ready decision before CLI compaction. The Host hands
-that source to the existing saved-capture presentation/reader owner, rather than
-discarding it and making the model evaluate another guard to obtain its current
-contract. Goal, Agent, Todo and Turn must match before publication. Required
-material reads, including an explicit complete Goal read, remain required; a
-ready receipt or saved file does not fulfill them. Optional presentation failure
-retains the original digest-bound recovery. Explicit off is inert, and an
-unbound request keeps its original readiness route without inventing a Turn.
-This is a bounded Host handoff repair, not C1 cutover, installed adoption or
-qualification of model cost and long-horizon benefit.
-
-The source already shares more than the output names suggest. `_emit_quota_result`
-captures the complete decision **before** `_project_quota_cli_payload` chooses
-ordinary CLI compaction or `buildTurnEnvelope`. The latter delegates to the
-TypeScript owner; its Python module is a transport adapter. Both quota capture
-and Turn journal capture call `write_decision_capture` in
-[`decision_capture.py`](../../../loopx/control_plane/turn_driver/decision_capture.py).
-Native context delivery and explicit host handoff also reuse that module and
-the existing context-delivery owner. C1 must converge the remaining composition
-and consumer assumptions, rather than introduce another capture service or
-rewrite already shared delta/native-resume logic.
-
-Optional host polling is part of that original observation. The source-fidelity
-slice records `--record-host-poll` once before capture and reuses its receipt in
-ordinary CLI, envelope and native-context delivery. Recovery reads do not poll
-again. A later capture/handoff failure retains the already-recorded observation
-in its error response; it does not imply missing admission or authorize replay.
-Default-off behavior and unreadable receipt diagnostics remain unchanged. This
-repairs capture completeness, not the unified writer/consumer cutover or a
-long-horizon cost-benefit result.
-
-A separate native-presentation slice reuses the committed full recovery as its
-reader target, avoiding an unused second wire publication. Delta and unwrapped
-inputs retain their own immutable files and the same reader/lifecycle owners.
-On a matched 107,289-byte synthetic source, capture writes fall from 216,754 to
-107,289 bytes; full reader bytes and the 3,937-byte warm delta are unchanged.
-This qualifies only duplicate capture IO removal, not model-input reduction,
-complete cost, accepted outcomes or C1 writer/consumer cutover.
-For a small explicit output ceiling, native presentation can also omit repeated
-directory/selection commands while retaining the complete recovery command:
-append `--list` or `--select` to discover/read current facts without a baseline.
-The original 4,000-byte cold/warm/compaction cases retain their requirements,
-Stop, original identity and full recovery; this is transport qualification.
-
-Journal persistence is an independent source-fidelity prerequisite. The proposed
-Python adapter reuses context delivery's sparse number-token collector; both
-TypeScript consumers reuse one source-number validator. Journals remain JSON
-objects, with metadata only for integral floats, signed zero and unsafe integers.
-The journal owner restores these numbers before atomic publication and retains
-their distinctions in replay and immutable-plan comparisons. Ordinary native
-objects retain their encoding; historical receipts are not rewritten.
-
-The interim whole-JSON-string carrier failed the existing 2 MiB request boundary
-for a synthetic 1.55-million-character quoted body accepted by the object path.
-Keep that negative result: qualify the sparse replacement against the same
-workload and limit, including number-dense overhead. Neither this prerequisite
-nor a component byte saving qualifies the unified writer/consumer cutover or
-long-horizon net benefit.
-
-The proposed Turn selection-reader slice removes the Python adaptive-selection
-decision from the driver. Its existing plan, Host, Session, completion and
-settlement callers use the interaction owner's `selectedWorkTodo` rule through
-the existing source-edit transport. The selection adapter retains Python's historical
-scalar/whitespace decoding; original records and numeric values stay intact.
-This retires one duplicate rule, not the historical envelope format. Complete
-writer/consumer cutover and original-quota outcome/full-cost qualification remain
-open. The added bridge calls must be counted; code convergence alone is no
-evidence of lower cost.
-
-| Current source / obligation | Present envelope treatment | Required C1 disposition |
+### 2026-11-06 audit: reusable foundations and remaining gaps
+
+This audit is pinned to main `f91e26d91d3e4e1b28b69f5881a059ea78891082`.
+A mechanism present in source establishes an implementation boundary, not a
+qualified dual-session journey or benefit.
+
+| Capability | Source fact / in-flight work | Design consequence |
| --- | --- | --- |
-| `interaction_contract.agent_channel.work_context` and pending required reads | `work_context` plus `required_reads`; identical inline material can be referenced | One complete requirement/evidence source with resolvable references; preserve pending reads and their completion conditions |
-| Selected Todo, recommended action, action portfolio and planning horizon | `action`; reference relocation and text compaction occur in `turnActionProjection` | One selected work/action identity; preserve complete actionable clauses and distinguish summaries from executable instructions |
-| `interaction_contract.cli_channel.settlement_plan` | Copied into `writeback.settlement_plan`, including original effect identity and conditional steps | Reuse the settlement owner unchanged; neither controller dialogue nor a new capture creates another debit identity |
-| User/agent interaction channels, execution policy and task orchestration | Separate `user`, `execution_policy`, `boundary` and orchestration sections | Preserve notification versus execution obligations, authority and stop gates; do not derive them from prose |
-| Replan packet, required reads and staged writeback | Dedicated replan projection and deferred writeback | Preserve fact/source access, policy-specific triggers and ordered mutations; no blanket activation of stride behavior |
-| Scheduler context and execution ownership | Scheduler projection with caller execution context | Carry the actual host owner and ACK obligations; a common schema does not transfer scheduler authority |
-| Complete saved decision, action signature and journal binding | Source hash, projected action hash and captured-decision reference are distinct | Preserve the distinction between semantic integrity, exact transport bytes and receipt identity; no hash substitution |
-
-This is an owner-and-obligation map, **not an exhaustive field inventory or a
-parity result**. Current projections have bounded text, allowlists and relocated
-references. Matching their action signatures alone cannot prove preservation of
-all source clauses or unknown fields. C1 implementation must enumerate those
-fields and callers against its exact base/head; anything unclassified holds
-cutover, rather than disappearing into an assumed compatibility view.
-
-A synthetic probe of the named baseline demonstrates the limit: two long
-`recommended_action` strings with identical prefixes but different tails produce
-the same action-signature document and both report `matches=true`, while their
-`source_decision_hash` values differ. An unregistered top-level source field has
-the same distinction. Conversely, a complete registered settlement plan survives
-projection, and changing its Turn identity changes the action signature. These
-observations reject promoting the existing bounded envelope unchanged into the
-complete contract. They do **not** establish a current authority-loss bug: the
-recommendation is diagnostic, the unknown field is synthetic, and the complete
-source commitment still distinguishes both inputs. No model benefit is measured.
+| Steward requests to several Agents and returns | [`manager_context`](../../../loopx/capabilities/manager_context/README.md) supports several recipients; [`semantic_request.ts`](../../../loopx/control_plane/collaboration/semantic_request.ts) retains exact recipients and original-conversation returns | Router adopts that request chain with per-recipient success/refusal; no routing task store |
+| Recipient identity and route | [`peer_route_selection.ts`](../../../loopx/control_plane/collaboration/peer_route_selection.ts) reports multiple candidates as ambiguous, not unknown as retired | Separate unit discovery from execution admission; integrate role mapping into current binding instead of bypassing ambiguity by choosing another native thread |
+| Request revisions and asynchronous input | [`request_control.ts`](../../../loopx/control_plane/collaboration/request_control.ts) owns revision/assessment/reservation; [`chat_queue_steering.ts`](../../../loopx/control_plane/turn_driver/chat_queue_steering.ts) persists reservations and uncertain delivery | Reuse mechanisms, but current queued steering explicitly excludes some collaboration/LoopX execution inputs and native live steer is text-only; dual-role correction is not delivered |
+| Original-audience return | [`return_delivery.ts`](../../../loopx/control_plane/collaboration/return_delivery.ts) distinguishes a provider write without a locator from no write | Router synthesis must not rerun tasks to repair delivery; delivery is not requester adoption |
+| Shared managed operations | Codex/DSH both call [`managed_operation_host.py`](../../../loopx/control_plane/turn_driver/managed_operation_host.py) and `select_managed_operation_session` | C3.1's generic-handler extraction already exists; reuse it and audit remaining callers instead of repeating the project |
+| Two-role binding | [`codex_sessions.py`](../../../loopx/control_plane/turn_driver/codex_sessions.py) stores sessions by Goal/Agent/Todo or Agent scope, without this proposed controller/worker pair | C3 needs roles/generations, independent queues and continuity within one Agent; two thread IDs alone are insufficient |
+| Unified work contract | Active quota/Turn format branches remain; [#7430](https://github.com/loopx-project/loopx/pull/7430) is an open C1 proposal, inspected at `3a4f6f64f288ab6c663c829ed5f5670c42d72595` | Coordinate with its owners and retain the original single-session outcome/cost gate; do not add router multi-unit delivery to its merge conditions |
+| Common Host transport | [#7568](https://github.com/loopx-project/loopx/pull/7568) remains Draft, inspected at `e3a3c06524fae99519a72d751a16a5e8dd6f9a5d` | A candidate adapter; bounded calls do not establish bidirectional long-lived sessions/asynchronous control. OAR or an all-Host rewrite is not a prerequisite |
+
+The annex below retains older field audits and experiments at their original
+revisions. Historical Draft/test records do not replace this status, and this
+audit does not relabel earlier evidence. Recheck live PRs and tasks before claiming
+implementation.
+
+### C1 source audit: shared owners and the remaining split
+
+The complete field, consumer and qualification detail is in [the contract and context annex](controller-executor-unified-contract-v0/contract-and-context.md#c1-source-audit-shared-owners-and-the-remaining-split).
## 5. Proposed architecture
+
+
+### Router, controller and worker: three user-facing responsibilities
+
+**The router is the steward's cross-Agent coordination role; controller + worker
+form one logical Agent binding unit.** Worker is the product term for this RFC's
+executor, not another role, protocol or registered entity. A unit retains its
+Agent identity, Goal ownership, work and budget while using two role sessions.
+Several units may serve one Goal or collaborate across authorized Goals. The
+steward's ordinary conversation needs no synthetic Goal and is not forced into
+two sessions by this design.
+
+Every request edge goes through existing runtime and authorization checks; it is
+not permission for arbitrary model-to-model messaging. The router aggregates only
+authorized returns, not every unit's private conversation. Cross-unit work reuses
+[semantic handoff](capable-manager-semantic-handoff-v0.md), without a privileged
+management tree.
+
+| Role / owner | Decisions and behavior it owns | Responsibilities it does not own |
+| --- | --- | --- |
+| Router / steward | Understand intent, discover context-affine capable units, propose reuse/creation, pass revisions, synthesize results and cross-task tradeoffs | Micromanage worker tools, claim/accept for receivers, copy Goal task stores or budgets |
+| Controller / within a unit | Select work from Goal, planning horizon and evidence; maintain continuity, interact with user/router, assess correction and acceptance, call Core | Become another authority or replace durable work with chat notes; approve every local tool step |
+| Worker / within a unit | Autonomously use tools, experiment, produce artifacts and report evidence/questions within admitted scope | Consume Core packets, author settlement or directly hold Core write access |
+| Core + managed execution + Host adapter | Existing typed rules, persistence, identity, dispatch, observation, stop and recovery | Infer authority/completion from prose or choose domain solutions for the model |
+
+The router may answer simple questions from sufficient existing evidence without
+creating a unit. Prefer reuse of an Agent whose current context and authority fit;
+new Agents still follow existing lifecycle and resource admission. Resolve
+ambiguous bindings rather than taking over by title similarity or recent presence.
+A router's priority is a request: the controller assesses local commitments and
+dependencies, returns adoption, deferral or refusal with reasons, and Core applies
+legal changes.
+
+
+
+### One Agent identity, two independent sessions
+
+```mermaid
+flowchart LR
+ A[Original Agent identity + exact Goal lifetime] --> C[Controller binding: role / generation]
+ A --> W[Worker binding: role / generation]
+ C --> CS[Native controller session + separate context baseline]
+ W --> WS[Native worker session + separate context baseline]
+ T[Original work / request revision / Turn] --> X[One admitted worker attempt]
+ W --> X
+ X --> E[Original effect identity and once-only settlement]
+```
+
+This is a binding relationship, not a new `AgentUnit` state store. Extend the
+existing session owner for roles, generations and native-session mapping; work
+identity, request revisions and receipts remain with their owners. Reconstructing
+a native session does not create a new logical Agent or task. Restarting or
+changing models cannot borrow the other role's context baseline.
+
+The first profile has one active controller consumer and at most one current
+worker attempt per unit. Units may run concurrently. Future internal parallel
+subtasks must use existing independent delegation/claim contracts, never duplicate
+the same attempt. A governed Turn is not a native model turn: three controller
+messages do not debit three business Turns, but all three model calls count in
+costs. Do not copy the team's resource allowance to every unit; the router adds
+no budget ledger.
+
+
+
+### The primary loop: select, execute, assess, feed back and continue
+
+**The controller is an active work partner, not only a help desk for a blocked
+worker or a reporting session.** An ordinary result, negative evidence or a
+ready continuation is work for the controller even when nobody sends a message.
+
+```mermaid
+flowchart TB
+ G[Current Goal, evidence and eligible work] --> C[Controller selects a useful work segment]
+ C --> A[Existing Core / runtime admits and binds execution]
+ A --> W[Worker executes autonomous tool / reasoning loop]
+ W --> E[Controller assesses findings and evidence]
+ E -->|Further work within the current grant| F[Feedback: continue, revise or request evidence]
+ F --> W
+ E -->|Governed work boundary reached| S[Validate and settle original identity]
+ S --> D[Fresh continuation decision]
+ D -->|Runnable work| G
+ D -->|Explicit wait / repair| H[Existing owner handles boundary]
+ H -->|Recorded trigger and fresh eligibility| G
+ D -->|Stop / terminal| Z[Stop at the proven scope]
+ U[User / router input] -.Update intent or request a response.-> C
+ E -.Useful evidence, optional reporting.-> R[Report / artifact return]
+```
+
+The arrows describe decisions, not one mandatory model call, new attempt or
+quota debit per arrow. Keep three existing boundaries distinct:
+
+| Loop | Who decides what | Boundary |
+| --- | --- | --- |
+| Worker reasoning ↔ tools | Worker chooses local methods within its task | No controller approval for each tool call; escalate material findings, questions or scope limits |
+| Controller ↔ worker | Controller compares evidence with the Goal, supplies feedback and selects the next useful segment | May span several exchanges within admitted work; feedback alone neither settles a Turn nor grants a new attempt |
+| Governed continuation across Turns | Existing Core/runtime validates original settlement and fresh admission | The model proposes work; the existing [Turn loop transition owner](../../reference/protocols/turn-loop-controller-v0.md) still decides legal continuation, waits and stops |
+
+Assessment is substantive: inspect evidence and unresolved acceptance, then
+continue the sound approach, correct it, request missing evidence or close the
+work. Do not rubber-stamp the worker's claim or force a strategy change merely
+to show activity. At a governed work boundary, validate and settle the original
+identity; use fresh admission for a subsequent Turn. Completing a segment, a Todo,
+a native model turn or a report does not by itself close the Goal. A genuine
+dependency, user-action, budget, stop or terminal condition remains effective;
+otherwise useful authorized work must not wait for the user to say “continue”.
+
+This logical loop is event-driven, not a blocking wait that occupies the
+controller session. Persist dispatch, observations, pending assessment and
+continuation through their existing owners. The host/runtime resumes eligible
+processing after a result or recorded wake; it does not keep a model polling.
+On recovery, reconcile the original attempt and unfinished decision/effect before
+continuing, without dispatching another worker merely to restart the loop.
+
+After handling a user/router input, **reselect from the current main-loop work**:
+an unevaluated result, owed feedback, eligible dispatch or settlement may be next.
+Do not blindly resume an old report. Reporting uses evidenced state in bounded
+opportunities while execution proceeds or the loop genuinely waits; it neither
+holds the main loop hostage nor becomes a requirement after every exchange.
+
+
+
+### Asynchronous control while the worker executes
+
+Asynchronous means **the worker's long operation does not occupy the controller's
+processing loop**, not concurrent conflicting decisions in one controller session.
+Persist the original attempt before dispatch and return a recoverable observation
+handle. Do not wait for the entire worker task while holding session or work locks.
+User input, router requests and worker events wake bounded controller processing
+through existing ordered ingress; commit decisions serially per unit. Host waits
+or subscriptions may remain active without model polling. An adapter that blocks
+until the entire task ends is unsupported for this asynchronous profile; a frontend
+that merely accepts messages does not qualify controller interaction.
+
+```mermaid
+sequenceDiagram
+ participant U as User
+ participant R as Router
+ participant C as Controller A
+ participant K as Core / request owner
+ participant H as Host runtime
+ participant W as Worker A
+ R->>K: Publish scoped request and original audience
+ K-->>C: Original request and current work basis
+ C->>K: Assess and request work admission
+ K-->>C: Original identity and allowed scope
+ C->>H: Record attempt, then dispatch
+ H->>W: Task and authorized materials
+ H-->>C: Original attempt observation handle
+ par Worker keeps executing
+ W->>W: Tools and experiments
+ W-->>H: Progress / artifacts / questions
+ and Controller keeps interacting
+ U->>C: Ask about progress / correct requirements
+ C->>K: Read current facts / persist revision
+ C-->>U: Evidenced answer and revision handling status
+ R->>C: Another dependency or coordination request
+ C-->>R: Assessed response
+ end
+ C->>H: Safe correction bound to original attempt
+ H->>W: Supported steer or next safe boundary
+ W-->>C: Version-bound result and evidence
+ C->>C: Assess result and unresolved work
+ opt More useful work within the current grant
+ C->>W: Feedback and next work segment via Host
+ W-->>C: Further findings and evidence
+ end
+ C->>K: At governed boundary, validate and settle original identity
+ K-->>C: Fresh continuation decision for the main loop
+ K-->>R: Result through existing return route
+ R-->>U: Conclusion, artifacts and remaining gaps
+```
+
+User and router inputs share the unit's durable ordered ingress and one control
+writer. Processing order follows the attention and causality rules below, rather
+than an unconditional FIFO queue; there are not two controllers. Invoke the model
+when a question needs semantic interpretation; existing status can be shown directly through typed readback.
+Worker events reach existing observation/journal ownership before triggering
+processing. Recover disconnection by cursor and state reconciliation, not a one-shot
+in-memory callback. Deduplicate by work identity; coalesce progress, but never
+silently drop pending cancellation, revisions, results or errors. A full queue
+returns readable deferral/unavailability and recovery. Reuse scheduler/ingress
+limits and waits, qualifying capacity per host instead of creating a message bus.
+
+| Input | May current work continue? | Handling and readback |
+| --- | --- | --- |
+| Query / artifact inspection | Yes; it does not mutate the attempt | Return recently evidenced state, revision and unknowns; questions do not redispatch work |
+| In-scope correction | At the actual safe consumption boundary | Persist revision; observe adoption after supported steer; otherwise queue for the next boundary and say so |
+| Scope / acceptance change / conflicting requirements | Recheck work that depends on the change | Bind expected revision and use the original owner; neither last-message-wins nor router priority overrides a conflict |
+| Stop / revocation | Enter existing stop handling immediately | Do not wait for the controller model or ordinary progress reports; distinguish recorded request, Host interruption and actual stop, reconciling unknown effects |
+| Worker result / late event | Assessment resumes the main loop, not unconditional new execution | Check original request, attempt, generation and revision; evaluate evidence, feed back or validate/settle at the work boundary, then use fresh admission for the next Turn; late evidence cannot complete another task |
+
+```mermaid
+flowchart LR
+ I[Input persisted] --> A[Receiver assessment]
+ A --> P[Adoptable: await safe boundary]
+ A --> D[Defer / refuse / conflict: return reason]
+ P --> T[Host delivery]
+ T --> O[Subsequent work proves adoption]
+ O --> V[Independent validation and original receipt]
+```
+
+These are evidence stages, not another registered state enum. Map them to existing
+request assessment, ingress, Host observation, validation and settlement facts.
+**Received is not adopted; delivered is not executed; executed is not accepted.**
+The same revision sent directly or relayed by the router shares its original
+request/idempotency identity. Genuinely different requests retain their identities
+and coordinate through explicit version dependencies, not text deduplication.
+There is no implicit global message order across units.
+
+
+
+### Controller attention: user intent first, interruption at safe boundaries
+
+**Default attention order: current user interaction → ready controller–worker
+main-loop work → ordinary router coordination → unsolicited reporting.** This is
+selection within a unit's existing ingress, not a new global task scheduler or a
+license to override authority. Keep three questions separate: whose intent governs,
+which eligible input needs attention next, and which current operation can yield.
+A higher-priority message does not automatically cancel a worker or a tool call.
+
+| Input / need | Attention policy | Boundary |
+| --- | --- | --- |
+| Authorized Stop, revocation or an enforced budget/fence | Existing deterministic control path runs independently of ordinary model work | Record and interrupt/reconcile through the current owner; never wait behind report generation or for a model to infer Stop |
+| Current user instruction, correction or question | Foreground; address before autonomous coordination and reporting | A status question is not a direction change. A user-requested report is foreground work, unlike an unsolicited report |
+| Main-loop dispatch, result assessment, feedback, continuation and settlement | Next; blocking worker exchanges take precedence within this work and may interrupt background composition | Ordinary results need assessment even without a help request. Routine progress/logs need no model wake unless they change a decision. Escalate required user approval without inventing it |
+| Router's autonomous coordination and nonblocking worker information | Serve after foreground and ready main-loop work, with bounded deferral | A verified relay of an original user request retains its origin and dependency; it is not demoted merely for passing through the router |
+| Unsolicited reports and optional housekeeping | Coalesce and run opportunistically in bounded slices | Refresh against current facts after interruption; do not send every obsolete draft |
+
+Explicit, applicable user intent governs conflicts with autonomous worker/router
+plans, within current authority and scope. Preserve older compatible requirements;
+a recent question does not supersede them. Rank using authenticated origin, original
+request/revision, current dependency and actual blocked state, never a sender's
+self-declared urgency or words such as “urgent” in source text. Unclassified input
+gets bounded assessment rather than a guessed permission change or silent drop.
+
+A required dependency may temporarily inherit the waiting foreground request's
+attention: if answering the user requires resolving a worker question, resolve that
+question first as part of serving the user. Record the existing request/dependency
+link and keep the inherited work bounded to that unblock; it gains no new authority
+and does not promote the worker's entire backlog. Apply the same rule to a necessary
+router dependency. Discover a cycle or missing permission as a blocker, not an
+excuse for endlessly escalating priorities.
+
+**Ordered ingress is not one global FIFO processing order.** Persist arrival and
+revision history unchanged; select among causally eligible pending inputs. Retain
+FIFO for equal attention and preserve per-request revision dependencies. A newer
+correction can invalidate an old draft, but its predecessor is recorded as
+superseded through the existing owner, not erased. A cancellation can invalidate
+pending dispatch immediately without first executing every earlier queued request.
+One controller commits decisions; priority never creates a second control writer.
+
+Preemption has three concrete forms:
+
+1. **Queued work:** select the higher-priority eligible input before starting an
+ unsent report. Keep original arrival/handling facts for recovery and readback.
+2. **Pure drafting / model reasoning:** yield cooperatively at a supported native
+ turn/tool boundary, or interrupt a cancellable model call. Retain a brief and
+ required evidence, not an assumed resumable model stack. Fence the old invocation
+ before another controls the same session; late output/tool proposals cannot
+ publish or mutate state. Recompose the report against current facts on resume.
+3. **An admitted tool/effect or atomic commit:** do not tear it down or infer rollback
+ from model interruption. Accept new input promptly; finish/recover the original
+ transaction or use its supported cancellation. Hold only dependent new effects
+ when an applicable change is pending; independent admitted work retains its
+ scope. Revalidate current revisions before subsequent dispatch/publication.
+
+“Interrupt reporting” therefore normally means interrupting the controller's
+composition, **not restarting or cancelling the business worker**. If a report send
+already happened or its delivery is uncertain, recover that original send before
+retrying; do not retract facts already observed or label a partial stream complete.
+Update visibly stale delivered material through the existing version/return owner.
+A Host without reliable interruption must bound controller slices and expose the
+actual wait; do not start concurrent calls in the same native controller session
+or claim prompt responsiveness for an uninterruptible long report.
+
+```mermaid
+sequenceDiagram
+ participant U as User
+ participant I as Existing ingress / runtime
+ participant C as Controller
+ participant W as Worker
+ C->>W: Dispatch admitted work via runtime
+ W->>W: Autonomous execution
+ W->>I: Ordinary result and evidence, no help request
+ I-->>C: Resume main-loop assessment
+ C->>C: Compare evidence and remaining acceptance
+ C->>W: Feedback and further work within current grant
+ Note over C,W: Worker continues while controller handles input
+ U->>I: Correct a requirement
+ I-->>C: User input ahead of ordinary router/report work
+ C->>C: Assess revision and dependent work
+ C-->>U: Explain adoption or actual pending boundary
+ C->>W: Apply qualified correction at safe boundary
+ W->>I: Further evidence
+ I-->>C: Reselect pending main-loop work
+ C->>C: Assess, continue or close through existing Core
+ opt Reporting is eligible
+ C-->>U: Updated evidenced report
+ end
+```
+
+Prevent both starvation and interruption storms. Batch compatible user corrections
+without losing their individual identities; coalesce supersedable progress, but
+retain questions, errors, results and settlement/recovery obligations. Bound each
+foreground service slice and reserve service opportunities for still-valid
+main-loop work and owed returns; ageing can advance those obligations without overriding
+Stop, explicit cancellation or intent. Optional stale reports can be superseded.
+If arrivals exceed capacity, show backpressure/deferred work and the actual blocker
+instead of promising an impossible latency bound. Do not repeatedly abort an
+in-flight foreground response for every keystroke, or ask the user to tune priority
+numbers. Existing quota/stop rules still bound the work and all wasted/interrupted
+model calls count in complete cost.
+
+For the MVP, qualify the autonomous main loop, stable selection and yielding
+**background composition** on one real Host; do not build arbitrary preemptive tool scheduling. Extend existing
+ingress/request/session facts only where the above origin, dependency and invocation
+fences are absent. The typed owner selects admissible input and protects commits;
+the controller assesses meaning. App/CLI and supported Lark readback distinguish
+input received, handling, deferred/blocked and actual adoption without exposing a
+priority console. This policy belongs to the optional unit profile; do not silently
+reorder current single-session chat queues. C3/C6/C8 own implementation and the
+attention acceptance below; a prose prompt alone does not implement the policy.
+
+
+
+### Failure isolation: losing a session does not lose the work
+
+```mermaid
+sequenceDiagram
+ participant R as Router
+ participant C as Controller A
+ participant K as Core / original journal
+ participant H as Host / Worker A
+ C->>K: Persist original dispatch intent
+ C->>H: Start original attempt
+ Note over C: Controller exits or disconnects
+ H->>H: Continue only within original grant, budget and boundary
+ R->>K: Read unit state, do not create a replacement worker
+ Note over C: Controller recovers with new control generation
+ C->>K: Recover pending input, attempt and original receipts
+ C->>H: Observe original attempt / recover original result
+ H-->>C: Running / complete / unknown
+ C->>K: Recheck current authority, reconcile or settle
+```
+
+An unavailable router does not stop admitted units just because their aggregate
+return channel is down. Direct interaction retains original audience limits.
+Without a controller, the worker may continue only its originally authorized,
+bounded work; new approval, scope change or dispatch waits for recovery. A
+replacement controller fences the old control generation without automatically
+rerunning a still-valid worker attempt as an orphan. Unknown external effects
+remain unknown; a timeout does not prove safe retry. Core/Host stop and budget
+limits do not depend on either model being online.
+
+Multi-recipient requests are not cross-Goal atomic transactions. If A adopts and B
+refuses, the router presents partial results and assesses another request,
+dependency revision or a needed user decision; it does not erase A's actual
+effects. Cross-unit artifacts retain version, provenance, permission and
+independent acceptance without broadcasting full private context. Rebinding or
+profile rollback first closes new admission, reconciles/stops the original attempt
+and pending effects, then continues with a newly qualified binding.
+
### Ownership and one contract
-```text
-Core owners <-> unified governed work contract <-> controller session
- |
- task / findings / artifacts
- |
- executor session
- |
- scoped host tools
-
-Host adapters enforce dispatch, session fences, interruption and transport.
-Core owners validate operations and commit existing effect/settlement receipts.
+```mermaid
+flowchart TB
+ D[Current decisions from existing domain owners] --> C[One semantic composition]
+ C --> S[Complete immutable capture]
+ S --> P[Progressive / full / delta delivery]
+ P --> M[Controller or qualified single-session consumer]
+ M --> O[Explicit typed operations]
+ O --> V[Core validation and original receipts]
```
Use the existing TypeScript interaction/work-context and effect owners. The
@@ -331,8 +665,8 @@ holds dependent work; independent authorized work keeps its existing route.
### Human interaction during execution
In a supported two-session profile, executor activity must not block the
-controller's user conversation. Reuse the existing role-bound ordered queues,
-versioned requests, host observations and original-audience return path. A
+controller's user conversation. Extend existing queues with role binding; reuse
+versioned requests, host observations and the original-audience return path. A
question or report does not start another business executor, interrupt an
authorized attempt without cause, or create another Turn debit.
@@ -461,7 +795,9 @@ its existing independent claim/lease/handoff contract.
generation, scope and budget. Record intent before invoking the executor.
4. The executor works and returns observations/artifacts. Readback distinguishes
delivery, execution, result availability, independent validation and accepted
- writeback. Dialogue can span several exchanges without multiple quota debits.
+ writeback. The controller assesses ordinary results and gives feedback through
+ the [primary loop](#controller-worker-main-loop), not only in response to a
+ blocker. Dialogue can span several exchanges without multiple quota debits.
5. The controller proposes acceptance or revision; the existing effect owner
validates and settles the original Turn exactly once. A fresh decision then
continues runnable work, waits on the recorded event/time or stops.
@@ -475,234 +811,14 @@ its existing independent claim/lease/handoff contract.
| Stop while a tool is running | Host interrupts within its supported contract; report acknowledgement and actual termination separately. Preserve unknown/in-flight effects; never claim physical rollback from a stop receipt |
| Controller is unavailable | Existing host/Core stop and budget mechanisms remain effective; hold dependent work and recover, without asking the executor to become Core owner |
-### Differential context
-
-Reuse the existing context-delivery owner and immutable capture mechanism.
-The target has two orthogonal layers; neither creates another semantic producer:
-
-- **Layer 1 — Progressive:** default model-facing delivery across LoopX hosts,
- including ordinary CLI, MCP/HTTP and external workers without Session Hooks.
- Keep the current Goal, applicable cumulative acceptance, failures/unknowns,
- authority, stop conditions and outstanding read/settlement obligations inline.
- Fold heavy history, source bodies and review evidence only through the existing
- typed composition owner, with exact current-capture read routes and explicit
- before-dependent-work obligations. Unknown relevance/schema keeps the complete
- necessary material. This is a delivery default, not permission to collect or
- persist additional data. A caller without an authorized, usable reader receives
- complete inline context; a local file path is not a working remote read route.
- If hard Host limits prevent both routes, expose unavailable context and hold
- dependent work.
-- **Layer 2 — Delta:** an exact encoding of the composed instance, automatically
- selected only with qualified consumer/session, role, epoch, schema and source
- binding. Progressive can use full encoding; a complete inline instance can use
- Delta. Qualify both combinations as well as Progressive plus Delta and neither.
- A host without qualified continuity uses current full encoding of Layer 1,
- without losing Progressive or requiring a native session to be invented.
-
-Distinguish two existing reuse claims. **`captured_file`** compares verified,
-compatible immutable saved artifacts; exact reconstruction does not require the
-model to have read the old file, reached EOF or retained its contents. **Retained
-model-input reuse** may omit previously delivered text only with trusted complete
-delivery and retention evidence for that exact consumer binding. A saved file,
-tool-output receipt or model self-acknowledgement cannot establish that evidence.
-Session Hooks observe their supported boundary; they grant no new authority.
-Preserve deletion, array order, null, empty values, original numeric values and
-complete strings. Unknown fields stay complete until reuse semantics are
-registered. Publish the current complete recovery source before an optional view
-or delta, verify reconstruction, and choose full when Delta plus its metadata is
-not smaller. Layer 1 likewise compares its final serialized UTF-8 view, read
-guidance and index with the same capture's complete alternative; use the smaller
-valid delivery, never trim mandatory meaning to meet a size budget.
-
-Current authority, admission, cancellation, unresolved-read, settlement and
-scheduler facts stay fresh and inline even if unchanged. A warm transport never
-relaxes the underlying instructions. Missing/out-of-order deltas, corrupt or
-unknown baselines select current full encoding/recovery. Truncated or missing
-reads recover the necessary range from the same capture. Compaction invalidates
-retention for the next work Turn's new baseline epoch; it neither invalidates the
-existing Turn nor forces an old-packet prefetch or immediate full reread. Preserve
-the original admission, recovery reference and once-only settlement/debit.
-Execution still checks current source validity and authority; recovering an old
-capture cannot revive cancelled work. The executor's task conversation consumes
-semantic material separately, not a relabeled controller Core-packet delta.
-
-#### Unread material across Turns
-
-Current immutable captures already support exact selected reads. The missing
-design is explicit discovery of unread material across deliveries, not a second
-reader or a requirement to consume an entire baseline. Extend the existing
-context/readback owner and native `session.json` projection; use its equivalent
-consumer binding on other hosts. Distinguish publication, model-visible delivery
-coverage, retention and semantic adoption/accepted outcomes.
-
-`confirmed_read_sections` is a proposed coverage projection;
-`consumed_pointers`, if retained as a name, must derive from that same owner,
-not become a second ledger or imply comprehension. Bind evidence to the exact
-source/capture digest, revision, consumer/session role, epoch, schema and selected
-pointer/range. Confirm coverage only from trusted Host observation of the actual
-model-visible result. Calling `--select`, file existence, reader EOF, a successful
-tool log or a self-ACK alone is insufficient. Partial/truncated/missing output
-stays unconfirmed; selecting a parent/index cannot confirm hidden descendants.
-Without such an observer, coverage is unknown and discovery stays conservative.
-This coverage never becomes a new full-read gate for `captured_file` Delta.
-
-Every warm delivery carries an **`unread_context_index`** (proposed name) for
-eligible non-inline material whose current content is unconfirmed or changed,
-including unchanged text omitted by Delta. Include exact current pointers,
-source revisions/digests and required-read status, rather than inferred relevance
-from a summary. A confirmed range applies only to its observed version; changed
-content, reordered arrays or ambiguous mappings require current rebinding and
-conservative discovery. Confirmed delivery never proves retained input or adoption.
-
-Each item resolves independently through existing `quota context-read --select`
-against the **current complete immutable `projection.json`**, with its exact
-capture SHA, without the previous packet, baseline file, model memory or patch
-chain. A derived `required-context.json` or wire view retains the existing owner's
-explicit mapping to the canonical source; roots and digests are not interchangeable.
-Historical exact-version lookup remains a separate, version-pinned artifact/read
-contract, not an invented path alias or a reason to silently use stale facts.
-If still-required earlier material is absent from the new projection, its owner
-must carry it forward or expose its current authorized source/read obligation.
-Legitimate expiry, revocation or removal must remain explicit, with unavailable
-required material holding dependent work; never silently mark it read or retain
-forbidden raw data. External materials keep their own source-consumption contract.
-
-#### Configuration and migration
-
-The following is proposed behavior, not a change to today's Codex-scoped
-`context_delivery` on/off interface. Evolve the existing typed configuration owner
-to express the two layer decisions; C1 maps exact names and versions before
-implementation. Do not add a parallel settings store or packet-format toggle.
-
-| Configuration / caller | Migration and effective behavior |
-| --- | --- |
-| No saved preference, model-facing caller | Target Layer 1 default applies after that caller's reader/fallback and cost qualification; Layer 2 is auto only for a qualified continuity host, otherwise full encoding. Today's ordinary CLI/other-host full behavior remains until that rollout qualifies. |
-| Explicit invocation/environment off | Preserve current precedence and full/raw delivery for that invocation, with no optional codec/coverage-ledger dependency; do not rewrite the saved preference. |
-| Existing persisted off | Preserve the complete off path and its original read/recovery obligations; never convert it to Progressive or Delta through an absent-preference migration. |
-| Existing on, supported host | Preserve the qualified native file/recovery semantics while mapping to Layer 1 plus qualified Layer 2 auto; no full-model-read prerequisite is introduced. |
-| Existing explicit on, unsupported host | Preserve the current validation error during compatibility. A versioned caller rollout may expose supported Layer 1 after qualification; do not silently reinterpret an unsupported request. |
-| New independently configured layers | Honor each layer independently, including Progressive off with qualified Delta auto. Explicit Delta off preserves Progressive; unsupported auto falls back to current full encoding. |
-| Internal raw machine consumers | Preserve their explicit `--context-delivery off` contracts; do not replace machine JSON with a model-facing file reference or mutate preferences. |
-
-Freeze recorded versions, experimental configurations and historical receipts.
-Qualify default expansion as a behavior change on real callers, including explicit
-off isolation and failure/recovery; a merged design alone changes no defaults.
+
+
+
+
-#### Delivery acceptance
-
-Reuse C1/C2's real-entry and §9 comparisons, including these decisive cases:
+### Differential context
-| Case | Required observation |
-| --- | --- |
-| Ordinary no-hook CLI and supported MCP/HTTP/worker routes | Layer 1 works through the actual authorized reader or complete inline fallback; no dangling local-only references or invented native epoch. |
-| Unchanged unread tail becomes decisive next Turn | Warm Delta may omit its bytes, but the current index exposes its full source and actual subsequent selection/work obeys the recovered constraint. Index visibility alone is not success. |
-| Changed/unread bodies, reordered arrays, unknown fields or scope | Rebind to the current source; preserve applicable cross-Agent obligations and unknown-scope complete fallback. |
-| Partial pages, lost/truncated tool output, EOF without a Host witness | Do not confirm unseen bytes or hidden descendants; recover missing ranges, conservatively index unknown coverage, and keep file Delta usable. |
-| Compaction, role/session/schema/epoch change | Invalidate incompatible retention/reuse; recover current facts without replaying the original admission, effects or debit, and without old-packet prefetch. |
-| Revoked source, missing reader or legitimately removed material | Respect the current permission/source owner; expose the loss and hold dependent work or use authorized complete fallback, without stale-data disclosure. |
-| Full is cheaper; off and legacy configuration | Choose valid full delivery, preserve explicit off and frozen versions, and observe both source identity and raw machine-consumer parity. |
-
-The primary stored-body reduction is **`1 - V/F`**: `F` is the complete capture's
-actual UTF-8 file bytes and `V` the selected view body file's actual bytes from
-that same capture; saved bytes are `F - V`. Bind both artifacts and their digests,
-and report wire/index overhead separately rather than changing that denominator.
-The delivery size guards above still include their actual presentation overhead.
-A net-benefit claim also counts all later reads/recovery, host/controller/executor calls and latency,
-actual tokenizer/cached/output usage, human attention and accepted outcomes.
-Preserve unfavorable cases and frozen budgets. A smaller packet alone proves
-neither lower token cost nor better outcomes; §9's original quota single-session
-comparison stays primary, and two-session costs remain a separate comparison.
-
-### Candidate context by decision stage
-
-Preserve complete candidate context in the canonical capture; deliver it according
-to the decision the consumer must make through the same C1/C2 owners. This is a
-proposed replacement contract, not permission to skip existing required reads.
-The current capability gate assigns selection to the Agent. A `selected_todo`
-projection or list order alone does not prove that comparison is finished. Keep
-the complete-context repair in [#7557](https://github.com/loopx-project/loopx/pull/7557)
-until consumers and recovery obligations are replaced together.
-
-| Decision stage | Required input before the dependent decision |
-| --- | --- |
-| Select or reconsider work | Complete discoverable candidate index: identity/revision, original objective, declared Goal contribution, priority, eligibility, ownership, dependencies/blockers, current evidence/uncertainty and exact captured detail reference. Missing facts remain unknown. Read full detail for compared alternatives; if the index cannot establish whether an alternative matters, expand it before choosing. Do not silently keep only a top-K set. |
-| Continue admitted work | Full selected task, original and cumulative requirements, applicable global/shared constraints, dependencies, contrary evidence, current authority and stops. A registered continuation contract may defer independent alternatives while exposing new/changed eligibility and evidence that can require reconsideration. An Agent still instructed to select over all runnable candidates remains in the selection stage. |
-| Replan or accept the Goal | Expand all affected work and acceptance, including cross-Agent dependencies and contradictory evidence. Unknown scope expands to the complete captured basis. Ownership and earlier local completion do not prove irrelevance. |
-
-These are consumer obligations, not three packet schemas or new scheduler modes.
-The typed owner determines which reads can be deferred under an explicit contract;
-the Agent/controller makes the semantic choice. Author-provided purpose or risk
-summaries help discovery but cannot prove omitted prose irrelevant. Do not infer
-relevance from keywords, claim labels or a model-authored score. Without sufficient
-typed facts, comparison can still require all bodies: cold selection has no
-promised compression ratio. Default expansion of the current Agent's outcomes is
-useful for ordinary work, with other outcomes discoverable; shared requirements,
-dependencies, conflicting evidence and unknown relationships override that default.
-Outcome scope and candidate selection remain distinct owners.
-
-Extend the existing immutable reader to batch selected details from the **same
-capture**, retaining each requested item's revision, lineage, integrity, coverage
-and cursor. Distinct revisions of one Todo stay distinct. Missing, truncated,
-unsupported or changed detail holds dependent work and uses that capture's full
-recovery; a fresh guard is not a detail reader. One read can deliver several bodies;
-verified bodies need not be repeated within a supported retained session. Reading
-an index never acknowledges hidden bodies. Retained-model reuse covers only text
-actually delivered and retained for that consumer; saved-file Delta has its
-separate artifact proof above. Newly required detail must supply its text even
-if the machine already holds it. Context loss recovers the required model
-artifact, widening to the full source when its scope is unknown. Historical captures
-keep their original obligations. Read receipts prove coverage, not comprehension,
-retention, fresh authority or acceptance.
-
-The single-session Agent consumes this same pipeline. In the controller/executor
-profile, the controller compares alternatives and absorbs Core bookkeeping;
-the executor receives the complete selected work and authorized materials through
-the existing host channel. It does not become a Core client or receive every
-alternative to compensate for an incomplete brief. Reuse capability eligibility,
-work-context/read fulfillment, capture/detail and delta owners; add no parallel
-candidate store, Python relevance policy or per-item approval round trip.
-
-Qualify against original quota single-session delivery and the corrected complete
-context on matched inputs. Include a decisive constraint at the end of an initially
-unexpanded candidate, a useful alternative beyond any display limit, changed peer
-evidence, a now-runnable blocker, identical titles with different requirements,
-missing metadata, context loss and failed batch reads. Actual choice and subsequent
-verified work must honor the constraint; reconstructable JSON or an unchanged
-selected ID is insufficient. Count initial input, all detail reads, paging, retries,
-recovery, both sessions' calls, latency and human intervention through accepted
-outcomes. Keep small-task and cold-selection counterexamples where staging costs
-more. Report bytes separately from tokens measured with the actual model tokenizer.
-
-Delivery stays within C1/C2: qualify the shared same-capture reader and required-read
-recovery through an actual caller; replace that caller's stage-specific delivery
-and obligations together; then qualify retained delta and matched outcomes/full
-cost. Reuse [#7560](https://github.com/loopx-project/loopx/pull/7560)'s outcome-scope
-work without treating outcome relations as candidate-selection proof. Diagnostic
-counter folding in [#7587](https://github.com/loopx-project/loopx/pull/7587) is a
-separate compatible slice, not this replacement. Each slice can have its own PR
-and rollback; no generic retrieval framework or two-session rollout is required.
-
-The native quota caller now implements a bounded acceptance-material slice:
-known cumulative objectives, complete requirement descriptions and current review
-states remain in its required view; source history and review notes/evidence are
-addressable in the original immutable capture. Its read obligation, full/delta
-baseline and recovery move together. Selected detail reads never fulfill hidden
-required content or establish a full baseline. Unknown semantics and signed
-envelopes remain whole; the disabled path is unchanged. The original capture's
-values survive the typed path plan without a JavaScript numeric round trip.
-If the required view plus its detail index is not smaller in serialized UTF-8
-bytes, retain full delivery and its original obligations. Default detail examples
-select source, note or evidence fields rather than replaying the whole outcome.
-
-Native exec and code-mode fixtures also qualify two compactions within one work
-Turn: a sufficient working brief continues with the original work/settlement
-identity without replaying its packet or re-entering admission. The baseline is
-still invalidated; unfinished initial reads and missing necessary facts require
-same-capture recovery, while a new work Turn obtains its fresh guard. This is
-native protocol qualification with deterministic inference, not evidence of
-model compliance or live outcome/cost benefit. C1/C2 remains incomplete:
-candidate, preference and Explore staging, signed-envelope migration and matched
-accepted outcomes with complete costs still need their own qualification.
+The complete field, consumer and qualification detail is in [the contract and context annex](controller-executor-unified-contract-v0/contract-and-context.md#differential-context).
## 6. Alternatives and design choices
@@ -714,6 +830,26 @@ accepted outcomes with complete costs still need their own qualification.
| Always use two sessions | Reject: controller cost, latency and lossy delegation may exceed the benefit; keep a qualified single-session profile |
| One universal runtime/effect executor | Reject: host, scheduler, transaction and provider permissions differ; share semantics and receipts, not ownership |
+### How external practice informs this design
+
+Primary sources inspected on 2026-11-06 inform mechanisms, not runtime dependencies
+or evidence of LoopX benefit:
+
+| Primary source | Design implication | What does not transfer directly |
+| --- | --- | --- |
+| [Anthropic: multi-agent research system](https://www.anthropic.com/research/multi-agent-research-system), 2025-06-13 | Independent contexts and handoffs suit decomposable long tasks; additional coordination and tokens belong in the value comparison | Parallel research gains do not establish cheaper coding or dual sessions; retain single-session and small-task counterexamples and complete costs |
+| [Temporal: Workflow message passing](https://docs.temporal.io/encyclopedia/workflow-message-passing) | Separate queries, asynchronous input and changes with a processing result; observe receipt separately from handling | No Temporal/second workflow engine, and Signal semantics are not LoopX acceptance receipts |
+| [Kubernetes: Controllers](https://kubernetes.io/docs/concepts/architecture/controller/) | Observe durable facts, request action and reconcile actual state; reconcile after restart rather than blindly replaying | LoopX's controller uses model judgment and business work is not always idempotently repeatable; deterministic admission and Host execution retain their owners |
+| [Akka: Mailboxes](https://doc.akka.io/libraries/akka-core/current/typed/mailboxes.html) and [sequential actor processing](https://doc.akka.io/libraries/akka-core/current/typed/actors.html) | Priority mailboxes can preserve equal-priority FIFO while a single consumer protects state; queue selection and in-flight handling are separate boundaries | No Akka dependency; mailbox priority does not guarantee model/tool preemption, and silent overflow loss is unsuitable here |
+| [A2A: Life of a Task](https://a2a-protocol.org/dev/topics/life-of-a-task/) (development version) | Distinguish conversation context, messages, tasks and versioned artifacts instead of making every message a new task | Do not copy its enums or terminal rules; retain LoopX request, work and effect identities. Protocol adapters need separate qualification |
+
+Async handlers must also account for state changes across waits; [Temporal’s TypeScript message-handling guidance](https://docs.temporal.io/develop/typescript/workflows/message-passing) informs concurrency coordination. Here the choice is one control commit owner and version rechecks, not assumed preemption of model calls or external effects.
+
+The choice is identity-bound asynchronous interaction with existing Core
+reconciliation, not an extra Agent layer for everything. Section 11's real outcomes
+and complete costs must determine whether this topology improves on single-session
+work.
+
## 7. Safety, privacy and compatibility
Controller reasoning grants no extra authority. Runtime credentials and Core
@@ -731,261 +867,11 @@ lossless mapping and explicit maintainer approval required by the RFC index.
## 8. Migration and rollback
+
+
### C1 wire-layout recommendation
-The target combines quota packet's decision-necessary information with
-TurnEnvelope's efficiency and replaces both. “Complete” means complete necessary
-semantics, not every duplicated diagnostic in today's packet permanently inline.
-The lossless root-preserving candidate below is an intermediate migration oracle:
-it exposes omissions and reference breakage while consumers move. Renaming that
-candidate or forwarding all old fields does not satisfy the final design.
-
-Inventory each field and instruction clause with its owning rule and consumer.
-Keep current task, original requirements and revisions, relevant evidence,
-authority, required reads, execution/stop conditions and original settlement
-obligations available before their dependent decision. Reuse typed ownership to
-remove proven duplicate representations and unrelated diagnostic noise. Stable
-material can be referenced or differentially delivered only with verified
-retention or a resolvable, integrity-bound source and explicit read ordering;
-missing context must recover before dependent work. A reference alone does not
-prove that the model received its constraints. Unknown fields cannot be silently
-classified as optional or dropped by a prose heuristic.
-
-Within one canonical contract, absorb the useful envelope properties: clear
-execution identity and action organization, a single machine-owned binding,
-less duplicate instruction text, bounded delivery and reliable detail/recovery.
-Full/delta/detail are encodings of that instance, not permanent competing semantic
-views. Preserve raw source evidence in its existing owner without emitting a
-second executable packet. The final wire layout may change where its mapped
-references, consumers and measured benefit justify it; root preservation is not
-an immutable product constraint.
-
-| Source or concern | Candidate mapping and qualification |
-| --- | --- |
-| Current decision fields during migration | Preserve path/value in the lossless oracle; enumerate all modes and classify necessary semantics, proven duplication and diagnostic-only material before the final mapping. Do not infer optionality from one observed packet. |
-| Work context, required reads and settlement | Keep their existing `interaction_contract` paths and owners. Existing root-relative references retain their meaning; any intentional relocation requires explicit reference and reader migration. Never rewrite prose or command strings by pattern. |
-| Host-operation binding | Compose from the actual caller execution context. Validate consistency with source authority; reject conflicting bindings rather than choosing whichever representation is convenient. |
-| Content and transport integrity | Commit the entire semantic instance independently of the former compact action digest. Preserve exact capture-byte verification and original settlement identity as separate checks; changing a transport encoding does not create a new effect. |
-| Complete capture and Progressive view | Keep canonical `projection.json` distinct from its derived `required-context.json`/wire view; inventory exact root, revision, digest and pointer mappings. Save complete recovery before presentation; reference only through an authorized usable reader. |
-| Saved-file reuse, delivery coverage and retention | Inventory each existing typed owner and its evidence boundary separately. Proposed `confirmed_read_sections`/derived `consumed_pointers` describe observed coverage only; neither is artifact-reconstruction proof, comprehension or a full-read gate for file Delta. |
-| Unread discovery | Map the proposed `unread_context_index` to current complete-capture pointers, revisions and source/read obligations, including unchanged unconfirmed material. Rebind changed/unknown mappings; retain explicit unavailable states and permission checks. |
-| Historical receipts and readers | Decode the recorded version for outstanding work. A temporary internal adapter may serve an existing effect interpreter, but must not become a second emitted contract or a compact replacement for the model's required input. |
-
-A synthetic layout probe used real isolated File/SQLite quota captures and the
-existing TypeScript context codec. Preserving source paths permitted warm delta
-encoding; moving all facts under a new `facts` key while retaining the old
-`quota_packet` surface fell back to full with `delta_not_smaller`. Both layouts
-reconstructed exactly, and an epoch change required full delivery. Retention was
-synthetically asserted; this measures codec behavior, not host observation,
-model comprehension or outcome/cost benefit. It rejects **unmapped root relocation
-under the existing surface**, not nesting in general. A redesigned nested layout
-remains possible if its mapping and consumers justify the migration cost.
-
-Therefore C1/C2 must explicitly version the context surface and its fresh/reuse
-paths with the wire transition. Do not relabel an old surface or inherit its
-baseline by Turn identity. The transition first saves a complete compatible
-source; the model-facing view may already be Progressive. Reuse requires the
-appropriate saved-artifact or retained-model proof above. Qualification includes fields
-outside the old action projection, missing baselines, session/epoch changes and
-same-capture recovery. This resolves a concrete layout risk; shared writer and
-final-consumer replacement remain the next implementation, not another layout
-framework or a declaration that C1 is delivered.
-
-The unfinished implementation candidate [#7430](https://github.com/loopx-project/loopx/pull/7430)
-now composes a complete source in the existing TypeScript owner before both
-quota and native Turn capture, and passes it to actual Codex stdin. Isolated
-File/SQLite CLI tests with a synthetic executable cover source integrity,
-failed-attempt recovery and once-only settlement. This advances the two-writer
-and final-input replacement; it does not qualify C1 cutover. The candidate
-now routes capability reentry through the canonical CLI channel and preserves
-original hash-bound review/writeback readers in complete-contract Codex input.
-Synthetic File/SQLite execution qualifies those readers for fresh obligation-bound
-and prior Todo-bound replans. Native launch now derives its one causal binding
-from the recorded settlement identity; an observed semantic replan obligation
-cannot replace an existing Todo binding. Source-quota and health refusals still
-prevent host launch. Release fixture setup now imports its final source once;
-these executable checks do not qualify a real model or installed host.
-The structured-host renderer now shares complete-input transport with Codex,
-including original hash-bound material readers. Actual isolated File/SQLite
-Turn-to-DSH runner paths receive that same captured source; historical request
-prompts retain their exact content. Structured DSH still has Todo-scoped
-sessions: an obligation-only replan is rejected before dispatch, rather than
-inventing a Todo binding. Full-source input deliberately retains inactive
-capability configuration and diagnostics; those facts do not activate recall
-instructions or reflection result fields. This is a disclosed presentation
-change, with activation and historical parity checked separately.
-The Markdown quota entrypoints now render the same complete contract rather
-than selecting a second subset of facts. Actual File/SQLite CLI captures retain
-every field and instruction under both the ordinary and former envelope flag;
-JSON types and arbitrary source text survive rendering. External-worker
-File/SQLite admission, unresolved-attempt recovery and restart checks pass with
-the complete producer output, but an opaque shell wake still does not prove
-delivery of that original contract to an executor model.
-The real benchmark checkpoint preflight now verifies complete source equality
-for File/SQLite, replan/non-replan and context delivery on/off. Its optional
-full recovery retains that same source, with one initial admission and no
-reader writes. This qualifies transport to the checkpoint's model-input file,
-not native session capture or a benchmark/model outcome. A matching outer
-source hash alone previously admitted an unsupported version or invalid inner
-binding through `replan-view`; the reader now uses the existing complete-contract
-validator, while unversioned historical reads retain their decoder.
-Successor authoring is now bound to the already-decided Turn before complete
-capture, using the same formatting owner as historical staged reads. The complete
-contract includes original Turn/Goal binding and the obligation to finish the
-creation receipt's original settlement before ending, without executing the
-successor. A later modern material read does not append another binding. Actual
-File/SQLite App-heartbeat and generic-CLI tests create the successor from this
-inline contract, reject premature spend, settle the original identity once and
-leave the successor open, without another guard or a staged reader dependency.
-This changes complete-input successor guidance; historical unversioned reads
-retain their old behavior. Settlement-only, capability-intent, unbound and
-mismatched-context inputs retain their authoring unchanged. The checkpoint's
-legacy-reader tests alone do not establish this lifecycle result. Remaining
-material-reader retirement and other C1 consumers must not restore a second
-compact executable fact view merely to satisfy historical assertions.
-The complete-contract boundary now rejects unknown, empty or mistyped root
-execution actions, using the existing decision/frontier vocabularies both
-before capture and on later reads. Valid hashes do not make unknown execution
-semantics supported. Optional evidence remains intact, including unfamiliar
-versions and action-like field names; historical unversioned action routing is
-unchanged. This qualifies the root action boundary, not every required semantic
-field. A real File/SQLite native-CLI producer fault is rejected before capture,
-dispatch or spend. The preceding candidate reached a later launch refusal;
-these probes do not show prior unguarded execution. Selected-work tests now consume the complete interaction context and
-use the actual native `turn plan` entrypoint for host input. Real File/SQLite
-checks retain full task text, canonical notes, scoped gates, fresh requirement
-reads and source-loss recovery without rebinding an App capture to a native
-host. The six earlier failures at obsolete root-layout assertions remain
-historical failures; their downstream semantic checks now execute.
-The six earlier staged-reader failures are retained as historical evidence.
-The complete composer now reuses Explore's existing applicability correction
-before capture: a proven pure replan without a Todo does not advertise the
-Todo-bound result attachment. Evidence, independent graph commands and all
-before-work obligations remain; unfamiliar/custom instructions and ambiguous
-bindings stay intact. Supported Todo-bound attachment authoring remains fully
-inline. This is an applicability correction, not an authority change or a new
-compact fact view. Real File/SQLite native host inputs qualify both bindings.
-The staged tests now consume the complete CLI input and exercise the historical
-material-reader codec against that same immutable capture, including a hostile
-PATH, unavailable registry, tampered identity/acceptance and the actual writer.
-They compare all successor-binding instructions rather than excluding fields
-that the complete input now owns. The attachment refusal fixture supplies a
-valid explicit finding status so it reaches the real missing-Todo identity gate.
-All 23 staged checks and four native host cases passed; these overlapping scopes
-do not establish full consumer retirement or packaged-host qualification.
-The native context fixture now binds both CLI spellings to `complete_turn` and
-compares reconstructed facts with the original captures. Its four initial
-failures came from constructing the restoration oracle with retired surfaces;
-a Unix rendezvous check had masked the same mismatch by accepting full fallback.
-The corrected checks require the original target and actual delta mode. Ten
-cases pass through real Codex exec/app-server/code-mode and worker resume with
-isolated SQLite and deterministic loopback inference, including compaction,
-process resume, replaced history and an unqualified replay profile. No paid
-model or benchmark experiment ran. The current full quota-settlement CLI module
-passes 158 checks, including the historical cache-parity case; the earlier
-intermittent mismatch is not causally explained or relabeled as a pass.
-The File/SQLite context-to-DSH subprocess checks now use the complete capture and
-production request builder instead of treating a current CLI response as a legacy
-action projection. Normal capability-on/off inputs retain every source fact;
-bound replan uses the production capture binder and executes the delivered
-original-evidence readers. Altered source facts, schema versions and replan
-obligations reject before the runner seam. The explicit historical reference
-reader remains covered. Eight focused cases pass with an injected recorder,
-not a live DSH model; runtime code is unchanged by this test migration.
-The complete-contract boundary now also reuses the existing interaction decoder
-for its required version, channel types, notification policy and execution
-consistency. Four negative cases previously passed composition despite invalid
-semantics; they now reject even when a producer supplies correct integrity
-hashes. The original object and unknown optional facts remain intact rather than
-being replaced with normalized decoder output. File/SQLite native input checks
-reject an unsupported inner version before Codex prompt execution or DSH runner
-loading, without spend. The complete-contract/context/DSH/stdio selection passes
-352 cases; TypeScript checking and focused lint pass. This qualifies these
-interaction semantics, not every required field or packaged-host adoption.
-Remaining cache consistency investigation, other old reader expectations, staged instruction parity and
-actual optional/external consumers, version admission and packaged host
-continuity remain unfinished. Operation-SDK checks without an explicit native
-runtime are untested, not qualified. The default writer change remains
-unshipped; the PR is Draft for unfinished author work, not merely pending review. No model or cost benefit is
-established. Historical effect decoding is temporary; it must not become a
-second permanent executable view.
-
-### C1 caller replacement and cutover unit
-
-The cutover unit is a supported entrypoint **and its downstream consumers**,
-not an output flag. Source inspection at `99921829f2c5` identifies the following
-live seams. This supplements the earlier baseline audit; it is a migration
-design, not a claim that these paths have changed.
-
-| Live seam | Concrete replacement and retained owner |
-| --- | --- |
-| `quota.py::_emit_quota_result` / `_project_quota_cli_payload` | Compose the complete contract before capture; replace the ordinary/envelope execution-format branch. Retain admission, capability hooks, capture IO and host poll receipts with their current owners. A diagnostic status view is not an executable contract. |
-| `turn.py` after `build_fresh_turn_decision_owner().resolve()` | Call the same composition owner with the actual scheduler execution context. This entry calls `build_turn_envelope` directly; changing quota CLI emission alone does not migrate Turn. Retain the Turn plan, journal and receipt executor. |
-| `heartbeat/task_body.py::render_thin_heartbeat_task_body` | Replace the `captured_envelope` instruction split with one contract-reading instruction. Preserve exact selection/reentry transport, notification independence, required reads and original settlement. The saved bootstrap still resolves current instructions on wake. |
-| `turn_driver/codex_cli.py::_prompt` and `host_candidate.py::extract_turn_authority` / `render_prompt` | Replace format-specific model inputs at the actual prompt boundary. Today ordinary Codex receives the envelope, staged replan uses extracted authority, and structured hosts use extracted authority. Shared source bytes or signatures do not prove these final inputs preserve the same obligations. Keep provider result encoding and outer effect ownership. |
-| `turn_driver/decision_capture.py` and `cli_commands/quota_capture.py` | Reuse immutable capture, validated readers and full/delta delivery. Fresh delivery and saved-capture recovery must reconstruct the same contract; do not reuse a continuity baseline for a different projection merely because its Turn identity matches. |
-| `benchmark/runtime/worker.py`, `benchmark/runtime/sessions.py` and `scripts/external_scheduler_worker.py` | Migrate the product entry they actually invoke. Keep evaluation setup and outer wake ownership; do not add benchmark-only conversion or count a managed-host test as attached-host acceptance. |
-
-Before replacing any seam, its implementation PR records source path, field or
-instruction clause, current readers, target owner, representation, recovery and
-retirement condition. Relocation must include reference resolution; an omitted
-diagnostic needs evidence that it carries no action, authority, required read or
-acceptance obligation. Unknown data cannot silently disappear. Unknown required
-execution semantics cannot be made safe merely by forwarding their JSON: the
-dependent operation stays unavailable until a compatible consumer understands
-them. Do not classify obligations by substring matching.
-
-Use **one explicit version transition**, not automatic format negotiation per
-wake. New admission for a migrated binding requires compatible composition,
-delivery and consuming readers. An unsupported consumer receives an actionable
-unavailable result before dispatch, without creating a second live writer.
-Already admitted work continues its recorded version and original receipts;
-retain its historical decoder until that work and the supported recovery window
-are reconciled. Rollback likewise separates outstanding work from new admission.
-A version transition does not rewrite saved prompts, journals or source hashes
-as if they had always used the new contract.
-
-The first C1 PR must include the two production composition callsites above and
-at least one complete producer-to-final-input journey, with an explicit list of
-remaining readers. Qualifying that bounded slice does not enable the new writer
-for an unqualified host or close C1. The final cutover removes active format
-choice only after all supported readers qualify. Temporary decoders have named
-callers and removal conditions; they are not user-facing compatibility views.
-
-For each normal, selection, replan, wait, recovery and capability-off fixture,
-check independently authored obligations at **three boundaries**: composed
-contract, reconstructed delivery, and final model input plus required material
-reads. Include a source change outside the old action signature, a missing
-required source, an incompatible consumer and a lost settlement response.
-Reconstruction equality alone misses prompt-layer omission; a complete prompt
-alone misses stale authority or a duplicate debit. These are integration
-requirements, not authorization to run a model or launch an experiment.
-
-1. Inventory actual producers, readers, writers, saved prompts, captures and
- external integrations. Map each old field and prose obligation to its retained
- owner/field, authoritative derivation or explicitly approved removal. No
- blanket claim of “same facts” suffices. Keep original failure fixtures.
-2. Qualify the unified contract in single-session execution through real quota,
- thin-heartbeat and Turn entrypoints. Switch one writer per binding; old
- readers are explicit version-pinned migration adapters with an identified
- caller and removal condition. They do not become permanent product views.
-3. Add role-aware sessions, shared lifecycle reuse and the opt-in two-session
- profile. Reuse existing same-session/native-resume and effect recovery code.
-4. Adopt the shared product profile in benchmark workers and the packaged App
- heartbeat journey. Each host proves its own observation, stop and recovery
- boundaries. Neither a CLI test nor a model simulation qualifies installed App.
-5. Remove old producers, format selectors, duplicate renderers and dual-format
- tests after the last supported active reader migrates. Keep only historical
- version decoders for supported receipt replay. End-state acceptance requires
- one emitted contract and no choice between quota and Turn packet formats.
-
-Rollback disables new admission for the affected profile, drains or interrupts
-its attempts, reconciles receipts and restores the prior qualified profile on
-the next admitted work. Do not silently replace native sessions or reinterpret
-pending receipts. Before field/decoder removal, demonstrate export, old-version
-readback and downgrade behavior; retain the old reader until the supported
-retention/upgrade boundary is satisfied. No destructive migration is authorized
-by this document alone.
+The complete field, consumer and qualification detail is in [the contract and context annex](controller-executor-unified-contract-v0/contract-and-context.md#c1-wire-layout-recommendation).
## 9. Validation and acceptance
@@ -1063,108 +949,7 @@ the added interaction and presentation costs in the optional two-session arm.
### C1 baseline boundary and reuse inventory
-The baseline is the **original caller-visible quota delivery**, not the raw
-internal decision. In `cli_commands/quota.py`, the original emitter captures the
-source, optionally applies `replan_cli_view` when a capture exists, then applies
-`compact_quota_should_run_cli_payload`. Native context delivery adds its own
-full/delta transport afterward. Record the exact revision, host flags, capture
-availability and detail options for both arms. Comparing a compact candidate
-against the larger internal source would overstate savings; comparing a full
-candidate against only a deferred entry would omit baseline follow-up costs.
-
-The existing paths already contain useful efficiency behavior. C1 should absorb
-its qualified semantics into the shared TypeScript composition/context owners,
-then retire the old caller-specific producer. Do not call the whole legacy
-compactor as a shortcut: exact sharing, omission and deferred reads have different
-information and failure consequences.
-
-| Existing information / transformation | Fusion disposition and decisive check |
-| --- | --- |
-| Selected work, original requirements, acceptance, evidence, permissions and stops | Available before the dependent decision. Keep distinct revisions and contradictory evidence; neither lane labels nor action signatures establish completeness. |
-| Identical acceptance copies, nested vision audits, authoring and optional guidance | Prefer one complete in-contract owner plus an exact reference where smaller. Compare JSON types and every clause; different/missing owners remain distinct. No extra read or new decision authority. Existing projection tests provide characterization, not new-consumer qualification. |
-| Bounded Todo lanes, shortened suggestions and omitted boundary/history entries | Treat as deliberate omission, not lossless deduplication. Retain completeness/count facts and same-capture recovery; prove the omitted item cannot change the current decision, or load it before deciding. Never inherit the old display limits as semantic limits. |
-| Captured replan review, acceptance detail and writeback readers | Separate decision facts from later authoring format while retaining the original identity and all required meaning. Bound reads to the same capture; count every required stage, error and recovery. A missing/stale reference must not trigger a new guard or authorize work. |
-| Full/delta/resume delivery | Reuse the existing continuity owner after composition. Establish exact semantic reconstruction and required material availability before action; charge cold fallback and lost-baseline recovery. |
-| Scheduler, admission and settlement identities | One authoritative instance before capture; transport must preserve host ownership, original Turn and once-only effects. Repeated representations do not justify weakening their checks. |
-
-A standalone late move of acceptance sharing is not automatically a useful
-prerequisite. A controlled source-level substitution against main
-`99cfa3ac559bfa237f04f36fb7e926672fea44b2` moved only that rule from the local
-CLI compactor into the existing `reference_context` call. On the same synthetic
-fixture with 100 distinct requirements, serialized projection input grew from
-102,680 to 344,010 bytes; the 102,189-byte caller-visible output stayed equal.
-The ordinary path still made one projection call; all-details delivery changed
-from local sharing to one call. These are projection-parameter measurements,
-not framed traffic, latency, model billing or the integrated C1 comparison.
-Retain this negative result rather than declaring a net efficiency win.
-
-The compatibility owner also uses one local JSON serialization identity for
-acceptance, Vision-audit and replan-authoring sharing. Python's ordinary value
-equality must not turn distinct booleans/numbers, integer/float representations
-or signed zero into an alias to another observation. Exact copies still share
-one in-response owner, including after key reordering; different facts remain
-complete. This repairs source fidelity without another projection RPC. It does
-not qualify the unified writer, final consumers or original-quota outcome/cost
-benefit.
-
-Repair relocated acceptance aliases at the current compatibility owner without
-that extra transport. Existing aliases must follow only inline owners actually
-moved by the projection, including aliases visited before their owner. Preserve
-complete values, original numeric types, carrier order and existing size checks;
-never infer arbitrary reference chains or rewrite saved captures. The complete
-C1 composition must absorb this rule at its source-owning boundary and retire
-the Python compatibility algorithm with its callers, rather than repeatedly
-shipping all acceptance copies across another bridge. Writer/consumer cutover
-and the original-quota outcome/full-cost gate remain open.
-
-A fixed-source synthetic replan audit of candidate `895f38fc5` illustrates why
-the boundary matters. With stride off and no capture staging, the raw source was
-21,461 compact UTF-8 JSON bytes, the original quota CLI projection 20,543, and
-the complete candidate 21,738: **+5.82% against CLI**, versus +1.29% against raw
-source. With capture staging, entry/review/writeback totaled 21,882 bytes versus
-21,821 for the candidate. With `evidence_conditioned_v1`, those staged bytes
-totaled 28,558 versus 33,368 for the candidate. These use the existing synthetic
-replan fixture and production projection/read functions with a synthetic capture
-route; they are not executed model trajectories or an installed-host trial.
-Extra acceptance/Explore reads, actual request framing, cache behavior and
-outcome differences are unmeasured. The legacy receipt toggle produced identical
-data and does not add an independent workload. No net-benefit conclusion follows.
-
-The next implementation slice should first qualify exact same-contract sharing
-through composition, readers and recovery, then assess deferred-detail choices
-with the matched workload above. Keep cold and staged totals separate and retain
-negative results; do not force a byte target by dropping unique instructions.
-
-Report the field/clause diff and its decision consequence together with actual
-model input, cached/uncached tokens, added reads/round trips, reconstruction,
-latency, failures/retries, verification and human intervention. A smaller first
-packet with more total reads can be negative. Judge positive only with preserved
-required semantics and comparable accepted outcomes at lower complete cost, or
-better accepted outcomes at comparable budget. Mixed results remain a tradeoff;
-transport-only passes and unmeasured outcomes remain inconclusive. Set numeric
-criteria before running matched experiments, using the existing measurement
-contract rather than inventing an arbitrary compression threshold. C1 cutover
-requires this quota-baseline comparison; a serializer or byte reduction alone
-cannot close it.
-
-Use the [existing measurement model](long-horizon-harness-benchmark-research-program-v0.md#6-measurement-model).
-Include both sessions' input/output/cached tokens, tool and material reads,
-planning/replan/recovery, wall time, verification, human attention and provider
-cost; unknown usage is not zero. Persist causal attribution without duplicating
-cost when an artifact is forwarded. Compare accepted outcomes under comparable
-budgets, not only replan counts or executor speed. Freeze criteria before any
-separately authorized experiment; this RFC specifies no automatic winner.
-
-For the later two-session comparison, attribute controller reasoning and all
-handoff/material, validation and recovery costs as well as executor work. The
-break-even question is whether those **added complete costs** are outweighed by
-avoided control/bookkeeping work, repeated execution or human intervention,
-while preserving comparable accepted outcomes. Account for actual repeated
-model consumption even when both sessions read the same artifact; forwarding
-one usage receipt must not double-count that receipt. Report workload-specific
-tradeoffs and unknown billing/cache coverage. No universal overhead threshold,
-compression ratio or per-message token ceiling is proposed. This comparison
-does not replace the prior original-quota versus unified single-session gate.
+The complete field, consumer and qualification detail is in [the contract and context annex](controller-executor-unified-contract-v0/contract-and-context.md#c1-baseline-boundary-and-reuse-inventory).
## 10. Operational contract
@@ -1190,6 +975,82 @@ No model busy-polling loop or new recurring automation follows from this RFC.
## 11. Normative delivery plan and refactor tasks
+
+
+### From current code to a useful product: dependencies and delivery slices
+
+```mermaid
+flowchart TB
+ C1[C1/C2: unified single-session contract and context] --> U[C3-C6: one real dual-session unit]
+ F[Existing request / managed-operation / Session owners] --> U
+ U --> I[C6/C8: autonomous work loop with conversation, correction and Stop]
+ I --> R[C6/C8: router connects two independent units]
+ I --> E[C7: unit outcomes and complete-cost comparison]
+ R --> E
+ E --> Q[C8/C9: scoped adoption and old-path retirement]
+ F -.Independent correctness repairs and caller simplification may land first.-> C1
+```
+
+These are actual dependencies, not a fixed queue every Agent must start at the
+first box. C1 retains its acceptance scope; shared-owner prerequisites, existing
+request/recovery repairs and removal of already-replaced code can land independently.
+A new profile's actual cutover depends on its unified contract being qualified,
+not every Host, language migration or benchmark being complete. Select work from
+the overall roadmap, current user outcome, bottleneck and in-flight owners; row
+numbers are not PR counts.
+
+| Slice within existing C tasks | Complete reviewable delivery / existing owner to adopt | Exit evidence and concrete simplification |
+| --- | --- | --- |
+| **C1/C2 — Finish existing contract cutover** | Converge #7430's source, consumer and recovery work; no router packet | Original single-session quota comparison, field/clause fidelity, real caller, off and recovery; remove each replaced format writer, retaining named historical decoders |
+| **C3/C4 — One binding unit** | Two roles in one Agent through current session/managed-operation owners; qualify one Host with isolation, observation and interruption | Two real sessions and independent context baselines; concurrent/restarted callers cannot overwrite bindings or let old generations write; remove replaced single-slot assumptions without another dual-session runtime |
+| **C5/C6.1/C8 — Work loop with interaction during execution** | Real long worker operation returns a handle; controller consumes user/worker input through request revisions, queue reservations, Stop and readback | Ordinary result → assessment/feedback → further execution without a user wake; original settlement and fresh continuation; substantive response before worker completion, correction changes subsequent artifacts, attention/safe-preemption/fairness cases pass, cancellation need not await a model; replace that caller's whole-task blocking wait and duplicate classification, delivering the same App journey |
+| **C6.2/C8 — Router connects two units** | Steward adopts existing multi-recipient requests, original-audience returns and selected bindings; direct controller input uses the same revision entry | B progresses while A is busy; partial refusal does not rerun A; restart returns results to original audiences without expanding permissions/budgets; remove duplicate synthesis/routing branches |
+| **C7/C8 — Compare and adopt narrowly** | Match workload/Host across original single-session, unified single-session and dual-session arms; separate additional multi-unit coordination arm | Comparable-budget outcomes and complete costs, response/correction/stop latency and human intervention; retain small-task counterexamples and model/Host boundaries. Qualify packaged App/CLI and supported Lark failure/recovery separately |
+| **C9 — Named retirement and default decision** | Retire each replacement with caller, historical-reader window and rollback evidence; decide adoption for qualified workloads/profiles | No second decision/task/budget ledger; original attempts reconcile after new admission closes; retain qualified single-session use, without treating fewer lines or more sessions as benefit |
+
+The recommended next implementation decision is to align in-flight C1 with current
+session ownership, select a Host that actually supports nonblocking worker
+observation, tool isolation and Stop, and deliver a reviewable “one autonomous unit loop +
+interaction during execution” slice. The steward's existing multi-recipient chain
+then adopts it. Binding/recovery simplifications that improve current callers may
+land first without waiting for all of C1. A global scheduler, generic message
+middleware, unlimited Agent hierarchy or third state store is unnecessary. Add
+missing bidirectional Host behavior to the real adapter; a unified interface alone
+is not delivery.
+
+
+
+### When this qualifies as a Superagent practice
+
+“Superagent” here is a product hypothesis: **an Agent unit that can be entrusted
+with long work, remains conversational during execution, recovers and returns
+evidenced outcomes**, not a model tier or a proven best practice. These cases
+jointly bound that claim:
+
+| Case | Independent oracle / comparison |
+| --- | --- |
+| No user/router messages after initial authorization | Ordinary worker findings lead to controller assessment, useful feedback and another admitted work segment without a help request or human wake. Verify changed artifacts and independent acceptance, not message counts; negative evidence changes the next decision when warranted. Settle original work once and continue under fresh admission; an evidenced wait/stop remains valid |
+| User question interrupts assessment or next dispatch | Answer, then select still-valid pending main-loop work from current facts. No lost result or stalled continuation, no automatic return to reporting and no replacement worker just to answer. Newly admitted segments retain their own identity |
+| Busy worker + user question + new router input | Substantive response before worker completion, both control inputs recorded, original worker-attempt count unchanged. Measure arrival→processing→response, not just queue ACK |
+| Same revision sent directly and relayed, then conflicting independent revisions | Same identity is not applied twice; different sources retain versions and handling reasons; actual subsequent artifacts obey effective requirements |
+| Two independent units + one refusal/disconnection | Unaffected unit continues; refusal/unknown visible, retry does not repeat successful effects, resources are not multiplied per unit |
+| Controller/router restart, reordered/duplicate results, lost settlement response | Recover original attempt, input and receipts; no duplicate execution/debit; old generations and late results cannot take over new work |
+| Stop/revocation with a full queue or unavailable model | Existing Host/Core stop remains reachable; acknowledgment and actual stop are distinct, unknown external effects still require reconciliation |
+| Unsolicited report + blocked worker, then user correction | Yield background composition and unblock; user correction precedes dependent new effects; the original worker is not restarted merely for interruption. Reselect main-loop work, updating the report only when eligible. Recover already-sent/uncertain delivery without duplicate sends |
+| Progress flood, router-relayed user request, equal-priority and reordered input | Preserve user provenance and required dependencies across transport; ordinary progress/self-declared urgency does not preempt; retain equal-attention FIFO and revision causality, including across restart |
+| Noncancellable operation / late model output races user input | Original effect completes/reconciles, old invocation's new tool proposals do not execute; no duplicate effects, actual wait/unsupported preemption readable, no concurrent replacement control writer |
+| Sustained foreground input and repeated interruptions | Under declared capacity, foreground stays responsive and valid main-loop work/owed returns do not starve; measure service latency, worker wait, oldest deferral and cancelled/repeated tokens. Overload is explicit backpressure; Stop does not queue |
+| Simple and long tasks under comparable acceptance | Compare full model/tool/recovery/reporting costs, omitted constraints, verified outcomes, correction rework and human attention. Single-session may win small tasks; faster interaction is not faster total completion |
+
+Reuse semantic oracles through the full chain on isolated real File/SQLite and the
+selected native Host, then qualify the packaged frontend. Changed PostgreSQL
+authority semantics require its isolated real-backend validation. Avoid a giant
+end-to-end fixture for every state permutation: share invariant tests, thin
+adapter tests and a few representative complete journeys. Freeze workload-specific
+thresholds under the existing measurement contract before experiments; untested
+or unknown is not passed. This RFC launches no paid experiment, changes no default
+profile and does not make this topology a prerequisite for all work.
+
These tasks extend roadmap S2/S4/S6/S7/S11 and the effect interpreter's existing
convergence work, not a new roadmap. Reconcile related active tasks/PRs before
claiming; reuse qualified fixes rather than reimplementing them. Task IDs below
@@ -1197,12 +1058,12 @@ are stable design references, not claims that a canonical Todo is complete.
| Task / dependency | Owner and concrete replacement | Decisive exit / rollback |
| --- | --- | --- |
-| **C1 — Unified contract; first** | Interaction/work-context + quota/Turn owners: inventory fields/instruction clauses, capture/view/read-evidence mappings and versioned two-layer configuration; capture one schema and migrate ordinary quota/Turn producers and thin renderer | Single-session real-entry parity with necessary information, action binding and once-only settlement, plus §9's quota-baseline effectiveness/full-cost comparison; preserve explicit off and version-pinned readers until cutover qualifies |
+| **C1 — Unified contract; new-profile cutover dependency** | Interaction/work-context + quota/Turn owners: inventory fields/instruction clauses, capture/view/read-evidence mappings and versioned two-layer configuration; capture one schema and migrate ordinary quota/Turn producers and thin renderer | Single-session real-entry parity with necessary information, action binding and once-only settlement, plus §9's quota-baseline effectiveness/full-cost comparison; preserve explicit off and version-pinned readers until cutover qualifies |
| **C2 — One context-delivery pipeline; C1** | Context owner + host observers: compose cross-host Progressive, independent qualified Delta, same-capture detail/recovery and conservative unread discovery; replace staged candidate delivery and duplicate packet branches | Unchanged unread constraints reach actual next-Turn work; qualify no-hook readers, exact evidence/continuity and all four layer combinations at complete cost; full fallback without a new admission; rollback encoding/configuration through the existing owner |
| **C3 — Session binding and native lifecycle; C1** | Session/runtime owner: extend existing binding for role/generation; reuse native create/resume/observe/interrupt and ordered queues | Two roles cannot overwrite the Agent native ID, cross-read baselines or race execution; recovery observes existing attempts before retry; disable new role admission to roll back |
| **C4 — Shared governed lifecycle; C1** | Effect/Turn owner + outer worker adapters: converge duplicated prepare/dispatch/observe/validate/writeback/settle orchestration around existing typed operations and receipts | App/Turn/external worker agree on admission, original result and single debit under partial failure; scheduler effects retain their true host owner; switch callers back only after receipt reconciliation |
| **C5 — Replan and result authoring boundary; C1** | Goal/Vision and interaction owners: expose current facts and typed controller operations; remove ordinary executor obligations to manufacture Core writeback fields in the two-session profile | Fact-first decision preserves default/stride policy differences, all evidence and required validation; invalid proposed writes reject; single-session authoring remains qualified during rollout |
-| **C6 — Controller/executor exchange; C2–C5** | Manager/request + host owners: reuse versioned semantic requests and result return; replace schema-constrained executor work with natural-language work/material exchange; keep user interaction available during execution | Complete sources, local autonomy, Core isolation, corrective exchange, actual feedback adoption through ordered revisions and independently accepted outcome; busy, conflict, stop and late-result cases in §9; return new work to qualified single-session profile on rollback |
+| **C6 — Controller/executor exchange; C2–C5** | Manager/request + host owners: reuse versioned semantic requests and result return; replace schema-constrained executor work with natural-language work/material exchange; keep user interaction available during execution | Complete sources, local autonomy, Core isolation, ordinary result → assessment → feedback → further work without human prompting, actual feedback adoption through ordered revisions, original settlement/fresh continuation and independently accepted outcome; busy, conflict, stop and late-result cases in §9; return new work to qualified single-session profile on rollback |
| **C7 — Benchmark reuse and full-cost attribution; C4/C6** | Benchmark toolkit/execution owner: thin adapters select the same product profiles; consolidate duplicated launch/session settings and track both sessions without changing frozen trials | Native/plain controls unchanged; matched-arm configuration/replay and complete cost coverage; no jobs launched merely by merging helpers |
| **C8 — Product configuration and operational readback; C3/C6** | Existing App/settings/Chat projections: one effective configuration owner, role-aware activity, failure/recovery, proactive evidence-based reports, task-appropriate rich views, feedback/readback, Stop and artifact return | Packaged managed and supported attached heartbeat journeys from §9, including unavailable host, late results, quiet/deduplicated reports, accessible fallback, audience denial and recovery; installed qualification separate; no new packet-format toggle |
| **C9 — Retire old paths and qualify adoption; C1–C8** | Contract/runtime maintainers: remove superseded producers, format switches, duplicated prompts and tests; update protocols, guides and RFC delivery facts | Caller/field/decoder retirement inventory, historical replay and rollback evidence; App + benchmark acceptance and matched benefit before any default promotion |
@@ -1335,7 +1196,7 @@ open PRs and canonical work before claiming one.
| Existing task / package | Simplification result | Start condition |
| --- | --- | --- |
-| **C3.1 Managed-operation protocol** | Codex and DSH adopt one operation-session flow; remove duplicated binding/profile checks and handoff/start orchestration, and DSH's dependency on a Codex-owned generic handler | When this duplication is the selected bottleneck: existing single-session behavior and two real callers; retain native differences |
+| **C3.1 Managed-operation protocol** | Generic handler and session selection are already shared; extend that boundary for roles and audit before removing remaining duplicated callers | Reuse `managed_operation_host.py`; do not reopen the completed extraction, and retain both real Hosts’ native differences |
| **C3.2 Session-binding callers** | Reuse shared persistence; eliminate caller-side binding reconstruction and private cross-host imports where a cohesive existing operation can replace them | Pair with C3.1 if a separate change would leave only a rename/facade; role/generation expansion waits for stable C1 |
| **C4.1 Receipt-to-continuation** | Adopt a qualified typed Turn observation/continuation boundary; retire replaced Python receipt reconstruction and decisions | Keep journal recovery distinct from next-work decisions; integrate C1 and existing recovery fixes |
| **C4.2 Outer-worker adoption** | Consume qualified semantic results instead of reconstructing common retry/continuation policy | C4.1; preserve wake ownership, original receipts and opaque-command uncertainty |
@@ -1394,6 +1255,16 @@ not full RFC acceptance.
cheaper controller models and different budgets are separate experiments.
Keep the profile opt-in until full outcome/cost evidence supports a decision.
+4. **Asynchronous Host/queue capability mapping — C3/C6 owners, before the first
+ unit rollout.** Name actual handle return, event recovery, role fences,
+ live-steer/next-boundary delivery, Stop and tool-isolation support. Qualify
+ capacity, attention selection, background yielding and response objectives for
+ that workload, not all Hosts by analogy.
+5. **Cross-unit budgets and original-audience synthesis — existing request/quota/
+ product owners, before C6.2.** Map resource limits and return identities,
+ partial failures and direct/relayed input deduplication. Extend missing typed
+ facts in their owners rather than creating another router ledger.
+
## Appendix A: Execution ledger
Source audits and subsequent delivery evidence live in
diff --git a/docs/architecture/rfcs/controller-executor-unified-contract-v0.zh-CN.md b/docs/architecture/rfcs/controller-executor-unified-contract-v0.zh-CN.md
index 67f4497243..d8ee8518c0 100644
--- a/docs/architecture/rfcs/controller-executor-unified-contract-v0.zh-CN.md
+++ b/docs/architecture/rfcs/controller-executor-unified-contract-v0.zh-CN.md
@@ -1,22 +1,60 @@
-# RFC：Controller / Executor 会话与统一受治理工作契约（v0）
+# RFC：Router—Controller—Worker 架构与统一受治理工作契约（v0）
-- **RFC 状态：** Accepted（设计接受在合并后生效）
+
+
+- **RFC 状态：** 既有设计 Accepted；本次 Router / 绑定单元扩展待评审
- **替代 / 关闭：** 无
- **交付成熟度：** Proposal；本文不交付新运行时、schema 或默认行为。
- **作者 / 负责人：** LoopX 维护者、控制面与运行时 owner
- **创建日期：** 2026-10-27
-- **最近规范性修订：** 2026-11-02
-- **实现基线：** `fe2b8dcbcb998647edb4bafb51932988bd7fdaa6`
+- **最近规范性修订：** 2026-11-06
+- **最新源码核对：** `f91e26d91d3e4e1b28b69f5881a059ea78891082`；旧实验保留各自基线。
- **相关契约：** [Effect interpreter](agent-loop-effect-interpreter-v0.zh-CN.md)、[会话执行模式](agent-session-execution-modes-v0.zh-CN.md)、[语义交接](capable-manager-semantic-handoff-v0.zh-CN.md)、[整体路线图](loopx-overall-roadmap-v0.zh-CN.md)
- **语言镜像：** [English](controller-executor-unified-contract-v0.md)
## 文档地图与维护契约
-英文与中文文档互为语义镜像；两者出现差异即为缺陷。
+**目标体验：管家路由多个 Agent；每个 Agent 持续完成 controller—worker 的选工作、执行、
+评估证据与反馈闭环。在这个循环中仍可沟通、纠偏与停止，结果沿原请求返回。** 这是一项待验证的长程 Agent
+架构选择，不宣称已经成为通用最佳实践。
+
+
+
+```mermaid
+flowchart TB
+ U[用户：App / Lark / CLI] <--> R[Router：管家会话]
+ R <-->|带范围的请求 / 返回| C1
+ R <-->|带范围的请求 / 返回| C2
+ U <-.->|直接交互，同一请求与受众规则| C1
+ subgraph A[Agent A：一个绑定单元]
+ C1[Controller：规划、交互、判断]
+ W1[Worker / Executor：执行、产物、证据]
+ C1 <-->|任务 / 纠偏 / 发现| W1
+ end
+ subgraph B[Agent B：另一个绑定单元]
+ C2[Controller]
+ W2[Worker / Executor]
+ C2 <--> W2
+ end
+ R <-->|路由 / 请求的 typed 操作| K[既有 Core owners 与所选 AuthorityStore]
+ C1 <-->|工作准入 / 原身份结算| K
+ C2 <--> K
+ W1 --> H1[受限 Host 工具]
+ W2 --> H2[受限 Host 工具]
+```
-第 4 节记录指定基线的源码事实；第 1–3、5–11 节定义提议的决策与验收；第 12 节记录
-待决事项。合并前本文是待评审提案。合并接受设计，不证明实现、安装、实验或默认提升。
-首次实现产出证据后，历史记录进入独立的日期 ledger。
+| 你要了解什么 | 阅读入口 |
+| --- | --- |
+| 为什么这样拆、当前差距 | 第 1–4 节；[最新源码核对](#current-delivery-audit) |
+| 三层关系与一个 Agent 的身份 | [系统图](#system-topology)、[绑定单元](#agent-binding-unit) |
+| 没有用户新消息时，工作怎么持续推进 | [执行主循环](#controller-worker-main-loop) |
+| 干活时怎么交流、停止、恢复 | [异步时序](#asynchronous-control)、[注意力与插队](#controller-attention-and-preemption)、[故障隔离](#router-failure-recovery) |
+| 怎么交付、验证和删代码 | [依赖与切片](#delivery-path-from-current-state)、[产品验收](#superagent-acceptance)、第 8–11 节 |
+| C1 字段、上下文、wire 与基线细节 | [技术附录](controller-executor-unified-contract-v0/contract-and-context.zh-CN.md) |
+
+中英互为语义镜像。主文维护当前设计；技术附录保留迁移细节，日期 ledger 保留历史证据。
+原章节锚点继续可达附录。设计接受、代码存在、打包/安装验收和收益资格是不同结论；
+本文不创建运行时、修改默认配置或启动实验。
## 1. 决策摘要
@@ -25,7 +63,7 @@
长期保留 quota/Turn 兼容视图不是目标。吸收 quota packet 的必要信息量优势与
TurnEnvelope 的交付效率优势，一起替换二者，并相对原 quota packet 路径验收净变化。
各 domain owner 仍决定自己拥有的事实。
-2. 在可选的双会话 profile 中，**controller 模型会话是唯一面向 Core 的模型客户端，
+2. 在可选的双会话 profile 中，**controller 模型会话是该单元工作控制与结算的唯一模型客户端，
也是控制工作的智能中介**。
它读契约、判断工作、与 executor 沟通并提交显式 typed Core 操作。Core 拥有合法迁移与
回执；controller 不是第二个权威。
@@ -37,9 +75,12 @@
Controller 与 executor 分别证明连续性，不能借用对方的基线；完整恢复始终可用。
5. 先在现有单会话路径验收契约统一；双会话保持 opt-in，直至可比成果与完整成本证据支持
采用。本文不启动 benchmark 或特权操作。
-6. Executor 工作期间，controller 仍应面向用户保持可交互：回答问题、主动解释有意义
- 变化、展现有用产物，并把反馈落实到后续工作。由 C6/C8 验收这条旅程；会话分离
- 本身不能证明已经交付。
+6. Controller—worker 执行循环是主干：既评估普通结果也处理阻塞，反馈并继续有价值的
+ 已准入工作，无需用户再发一句话。Executor 工作期间，controller 同时回答用户、
+ 采用纠偏、展现有用产物。汇报是旁路活动，不是循环的默认归宿；两者由 C6/C8 验收。
+7. 将管家定位为 **router**：经既有语义请求协调多个 controller + worker 绑定单元。
+ 每个单元沿用一个 Agent 身份；router 可调用获授权的请求/路由操作，不替接收单元
+ 进行工作结算。先交付一个单元的异步闭环，再复用多接收方链。
## 2. 问题与动机
@@ -73,7 +114,7 @@
复用、宿主 adapter、benchmark 采用、旧路径退役与可观察的产品验收。
非目标：新 Goal store、workflow DSL、通用 effect executor、权限引擎、scheduler、
-强制双 Agent 团队、自动切换宿主或修改 benchmark 评分。Peer 团队沿用现有委派/验收
+强制双会话、无限层级团队、自动切换宿主或修改 benchmark 评分。Peer 团队沿用现有委派/验收
契约，不把业务判断移入确定性的 Core 规则。
## 4. 当前系统契约
@@ -94,97 +135,348 @@
组织与评估组是独立维度；并非所有组合都受支持。Native/plain benchmark 对照可以有意
不包含 LoopX Core，必须保留其独立性。
-### C1 源码核对：已有共享 owner 与剩余分叉
+
-绑定 Turn 的原生执行准备保留普通 managed claim 原引用，并在 CLI 压缩前捕获同一
-Turn 的 ready 决策。Host 将该原件交给既有 saved-capture 展示/reader owner，不丢弃
-它再要求模型重算 guard 才能取得当前契约。发布前须核对 Goal、Agent、Todo 和 Turn。
-必需材料读取（包括显式的完整 Goal 读取）仍须执行，ready 回执或已保存文件不能代替
-读取。可选展示失败保留原摘要绑定的恢复引用；显式 off 不产生动作，未绑定请求沿原
-readiness 路径，不补造 Turn。这只是有界的 Host 交接修复，不代表 C1 切换、已安装
-采用，或模型费用与长程收益已取得资格。
-
-源码实际共享的部分比输出名称体现的更多。`_emit_quota_result` 在
-`_project_quota_cli_payload` 选择普通 CLI 压缩或 `buildTurnEnvelope` **之前**，
-已经捕获完整决策。后者委托 TypeScript owner，Python 模块是传输 adapter。
-Quota capture 与 Turn journal capture 都调用
-[`decision_capture.py`](../../../loopx/control_plane/turn_driver/decision_capture.py)
-中的 `write_decision_capture`。原生上下文交付与显式宿主 handoff 也复用该模块和既有
-context-delivery owner。C1 应收敛剩余的组合逻辑与消费者假设，不另建 capture service，
-也不重写已经共享的差分与 native-resume 逻辑。
-
-可选 host poll 也是该次原始观测的一部分。来源保真切片在 capture 前仅记录一次
-`--record-host-poll`，普通 CLI、envelope 与原生上下文交付复用同一回执；恢复读取不再
-轮询。后续 capture/handoff 失败的错误响应仍携带已记录观测，不表示缺少准入，也不
-授权重放。默认关闭行为和不可读回执诊断不变。这只修复 capture 完整性，不代表统一
-writer/consumer 切换或长程成本收益已取得资格。
-
-独立的原生展示切片复用已提交的完整恢复原件作为 reader 目标，避免再次发布未使用的
-wire 副本。Delta 与未包装输入仍保留各自的不可变文件，reader/lifecycle owner 不变。
-同一 107,289 字节合成来源的 capture 写入从 216,754 降为 107,289 字节；完整 reader
-字节及 3,937 字节的 warm delta 均不变。这只验证重复 capture IO 的消除，不证明模型
-输入减少、完整成本收益、成果验收或 C1 writer/consumer 切换。
-显式小预算下，原生展示还可省略重复的目录/选读快捷命令，保留完整恢复命令；
-在其后追加 `--list` 或 `--select`，无须基线即可发现或读取当前事实。
-原有 4,000 字节冷态、温态及压缩恢复用例保留完整要求、Stop、原身份和完整恢复；
-这属于传输验证。
-
-Journal 持久化是独立的来源保真前置。本次提议由 Python adapter 复用 context
-delivery 的稀疏数值 token 收集器；两个 TypeScript 消费者复用同一来源数值校验器。
-Journal 继续传递 JSON 对象，仅为整值浮点、带符号零和非安全整数增加元数据。
-Journal owner 在原子发布前恢复这些数值，并在重放与不可变 plan 比较中保留其
-区别。普通原生对象保留已有编码，不改写历史回执。
-
-中间的完整 JSON 字符串方案，在合成的 155 万字符带引号正文上超过既有 2 MiB
-请求边界；原对象路径能够接收同一负载。保留这一负面结果：稀疏替代须在相同
-负载与上限下比较，包括数值密集时的元数据开销。该前置或组件字节减少，都不
-构成统一 writer/consumer 切换或长程净收益的资格。
-
-本次提议的 Turn 选择 reader 切片删除 driver 中 Python 的 adaptive 选择判断。
-现有 plan、Host、Session、completion 和 settlement 调用方经既有 source-edit
-传输复用 interaction owner 的 `selectedWorkTodo` 规则。此选择 adapter 仅保留
-Python 标量与空白解码，原记录和数字值不变。这退役的是一条重复规则，不是历史
-envelope 格式；完整 writer/consumer 切换和相对原 quota 的成果／完整成本资格仍
-开放。新增 bridge 调用必须计入，代码收敛本身不证明成本降低。
-
-| 当前来源 / 义务 | 当前 envelope 处理 | C1 必须保留的归属与语义 |
+### 2026-11-06 核对：可复用什么，还缺什么
+
+以下检查绑定 main `f91e26d91d3e4e1b28b69f5881a059ea78891082`。
+代码中存在机制只证明已有实现边界，不代表双会话用户旅程或收益已经验收。
+
+| 能力 | 源码事实 / 在途工作 | 对本设计的决定 |
| --- | --- | --- |
-| `interaction_contract.agent_channel.work_context` 与未完成必读 | `work_context` 加 `required_reads`；相同内联材料可改用引用 | 一份完整要求/证据来源与可解析引用；保留未完成必读及其完成条件 |
-| 选定 Todo、recommended action、action portfolio 与 planning horizon | `action`；`turnActionProjection` 进行引用迁移与文本压缩 | 一份选定工作/动作身份；保留完整可执行条款，区分摘要与执行指令 |
-| `interaction_contract.cli_channel.settlement_plan` | 复制至 `writeback.settlement_plan`，包含原 effect 身份与条件步骤 | 原样复用 settlement owner；controller 对话和新 capture 都不另建扣款身份 |
-| User/agent interaction channel、execution policy 与 task orchestration | 分为 `user`、`execution_policy`、`boundary` 与 orchestration 分节 | 保留通知与执行义务的区别、权限和停止 gate；不从正文猜测 |
-| Replan packet、必读与分阶段写回 | 专门的 replan 投影与延后写回 | 保留事实/来源访问、policy 特定触发与有序变更；不统一打开 stride 行为 |
-| Scheduler context 与执行归属 | 携带调用方执行上下文的 scheduler 投影 | 保留真实宿主 owner 与 ACK 义务；统一 schema 不转移 scheduler 权限 |
-| 完整已保存决策、action signature 与 journal 绑定 | 来源 hash、投影动作 hash、captured-decision 引用分别存在 | 区分语义完整性、精确传输字节与回执身份，不互换 hash |
-
-这份表是 owner 与义务映射，**不是完整字段清单，也不是等价验证结果**。当前投影有文本
-预算、字段白名单和引用迁移；仅比较 action signature，不能证明完整来源条款与未知字段
-都被保留。C1 实现必须按确切 base/head 枚举字段和调用方；未分类项阻止切换，不能以
-假定的兼容视图为由悄悄丢弃。
-
-对上述基线的合成探针展示了这一限制：两段前缀相同、尾部不同的长 `recommended_action`
-产生相同的 action-signature document，且均返回 `matches=true`，但各自的
-`source_decision_hash` 不同。未注册的顶层来源字段也有相同区别。反之，完整的已注册
-settlement plan 在投影中保留，改变其 Turn 身份会改变 action signature。这些观察
-排除了直接把现有有界 envelope 原样提升成完整契约的路线，**不证明当前发生权限丢失**：
-recommendation 属于诊断，未知字段是合成输入，完整来源承诺仍能区分两份输入。
-没有测量模型收益。
+| 管家到多个 Agent 的请求与返回 | [`manager_context`](../../../loopx/capabilities/manager_context/README.md) 已支持多接收方；[`semantic_request.ts`](../../../loopx/control_plane/collaboration/semantic_request.ts) 保留精确接收方和原对话返回 | Router 采用原请求链；逐接收方成功/拒绝，不新建路由任务库 |
+| 接收方身份与路由 | [`peer_route_selection.ts`](../../../loopx/control_plane/collaboration/peer_route_selection.ts) 对多个候选返回 ambiguous，不把 unknown 当作已退役 | 发现单元与准入执行分离；把新角色映射接进现有绑定，不能靠另选 native thread 绕过歧义 |
+| 请求修订与异步输入 | [`request_control.ts`](../../../loopx/control_plane/collaboration/request_control.ts) 已有 revision/assessment/reservation；[`chat_queue_steering.ts`](../../../loopx/control_plane/turn_driver/chat_queue_steering.ts) 已有持久 reservation 和不确定投递处理 | 复用机制，但现有 queued steering 明确排除部分 collaboration/LoopX execution 输入，且 native live steer 限文本；不能宣称双角色纠偏已支持 |
+| 原受众返回 | [`return_delivery.ts`](../../../loopx/control_plane/collaboration/return_delivery.ts) 区分 provider 已写入但无定位符与未写入 | Router 汇总不得重新执行任务来补投递；投递不等于 requester 采用 |
+| 受管操作复用 | Codex/DSH 均调用 [`managed_operation_host.py`](../../../loopx/control_plane/turn_driver/managed_operation_host.py) 与 `select_managed_operation_session` | C3.1 的通用 handler 抽取已存在；复用并检查剩余调用方，不重复开重构项目 |
+| 双角色绑定 | [`codex_sessions.py`](../../../loopx/control_plane/turn_driver/codex_sessions.py) 按 Goal/Agent/Todo 或 Agent scope 保存 session；尚无本提案的 controller/worker 成对绑定 | C3 需要同一 Agent 的 role/generation 与独立队列、连续性；仅有两个 thread ID 不够 |
+| 统一工作契约 | quota / Turn 活跃格式分支仍在；[#7430](https://github.com/loopx-project/loopx/pull/7430) 是开放的 C1 提案，本次核对头 `3a4f6f64f288ab6c663c829ed5f5670c42d72595` | 与其既有 owner 协同，保留原单会话成果/成本验收；不把 router 多单元交付追加为它的合入条件 |
+| 通用 Host transport | [#7568](https://github.com/loopx-project/loopx/pull/7568) 仍为 Draft，本次核对头 `e3a3c06524fae99519a72d751a16a5e8dd6f9a5d` | 可作为适配器候选；bounded 调用不证明双向长期 session/异步控制，不把 OAR 或全 Host 重写设为先决条件 |
+
+旧的逐字段审计与实验保留原版本，位于下面的技术附录；其中历史 Draft/测试记录不能
+代替本表的状态，也不能用本表给旧结果重新标注版本。下一次认领须重查实时 PR 与任务。
+
+### C1 源码核对：已有共享 owner 与剩余分叉
+
+完整字段、消费者与验证细节见[契约与上下文迁移附录](controller-executor-unified-contract-v0/contract-and-context.zh-CN.md#c1-源码核对已有共享-owner-与剩余分叉)。
## 5. 提议架构
+
+
+### Router、Controller、Worker：面向用户的三层分工
+
+**Router 是管家的跨 Agent 协调角色；controller + worker 是一个逻辑 Agent 的绑定单元。**
+Worker 是本文既有 executor 的产品称呼，不增加第二种角色、协议或注册实体。
+一个单元保持原 Agent 身份、Goal 归属、工作与预算，内部使用两个角色会话；多个单元
+可以服务同一 Goal，也可以在已授权范围内跨 Goal 协作。管家自己的普通对话不需要
+虚构 Goal，也不因本设计被强制拆成两个会话。
+
+图中每条请求边都要经过既有 runtime 和授权校验；不是模型间任意发消息的权限。
+Router 只汇总获授权的结果，不能因此读取所有单元的私有会话。跨单元协作复用
+[语义交接](capable-manager-semantic-handoff-v0.zh-CN.md)，不增加一棵拥有特权的管理树。
+
+| 角色 / owner | 负责的判断与行为 | 不承担的职责 |
+| --- | --- | --- |
+| Router（管家） | 理解用户意图，发现有上下文和能力的单元，选择复用/创建的提议，传递修订，汇总结果及跨任务取舍 | 不逐工具指挥 worker，不替接收方认领/验收，不复制各 Goal 的任务库与预算 |
+| Controller（单元内） | 结合 Goal、planning horizon 与证据选择工作，维护任务连续性，与用户/router 交互，判断纠偏与验收并调用 Core | 不成为第二权威，不用自己的聊天笔记代替工作状态；不必为每个工具步骤审批 |
+| Worker（单元内） | 在已准入范围内自主使用工具、实验、产出及报告证据/问题 | 不消费 Core packet，不编造结算，不直接持有 Core 写权限 |
+| Core + 受管执行 + Host adapter | 既有 typed 规则、持久化、身份、派发、观察、停止和恢复 | 不从自然语言猜权限/完成，不替模型决定领域方案 |
+
+Router 可以直接回答已有证据足够的简单问题，不必每次创建单元。分配工作优先复用
+当前上下文与授权匹配的 Agent；创建新 Agent 仍沿既有生命周期和资源准入。多个候选
+绑定不明时先消歧，不能按标题相似或“最近在线”抢占。Router 给出的优先级是请求；
+controller 结合本地承诺与依赖评估并返回接受、延后或拒绝及理由，Core 执行合法变更。
+
+
+
+### 一个 Agent 身份，两个独立会话
+
+```mermaid
+flowchart LR
+ A[原 Agent 身份 + 精确 Goal lifetime] --> C[Controller binding：role / generation]
+ A --> W[Worker binding：role / generation]
+ C --> CS[原生 controller session + 独立上下文基线]
+ W --> WS[原生 worker session + 独立上下文基线]
+ T[原工作 / 请求 revision / Turn] --> X[一个获准 worker attempt]
+ W --> X
+ X --> E[原 effect 身份与一次结算]
+```
+
+这是绑定关系，不是新增 `AgentUnit` 状态库。角色、generation 和原生 session 映射由
+既有 session owner 扩展；任务身份、请求修订和回执仍由各自 owner 保存。原生 session
+可以重建，逻辑 Agent 不随之变成新任务。重启/换模型后不能借用另一角色的上下文基线。
+
+首个 profile 中，一个单元有一个活跃 controller 消费者、至多一个当前 worker attempt。
+多个单元可以并行；内部并行子任务将来只能使用既有独立 delegation/claim 契约，不能
+把同一 attempt 复制多份。业务 Turn 与原生模型轮次不同：controller 回复三条消息
+不等于扣三次业务 Turn，但这三次模型调用都必须计入成本。团队资源上限不能给每个单元
+各复制一份；router 不新增预算账本。
+
+
+
+### 执行主循环：选工作、执行、评估、反馈、继续
+
+**Controller 是主动推进工作的搭档，不只是 worker 阻塞时的答疑台，也不是汇报专用会话。**
+普通结果、负面证据、已可继续的工作，即使没有人发消息，也需要 controller 处理。
+
+```mermaid
+flowchart TB
+ G[当前 Goal、证据与合格工作] --> C[Controller 选择有价值的工作段]
+ C --> A[既有 Core / runtime 准入并绑定执行]
+ A --> W[Worker 自主工具 / 推理循环]
+ W --> E[Controller 评估发现与证据]
+ E -->|当前授权内仍有工作| F[反馈：继续、纠偏或补充证据]
+ F --> W
+ E -->|到达受治理工作边界| S[验证并按原身份结算]
+ S --> D[新鲜的继续决策]
+ D -->|有可执行工作| G
+ D -->|明确等待 / 修复| H[既有 owner 处理边界]
+ H -->|已记录触发与重新核验资格| G
+ D -->|停止 / 终态| Z[按已证实的范围停止]
+ U[用户 / router 输入] -.更新意图或请求答复.-> C
+ E -.有用证据，择机汇报.-> R[报告 / 产物返回]
+```
+
+箭头表达决策关系，不代表每条箭头强制调用一次模型、新建 attempt 或扣一次额度。
+区分三个既有边界：
+
+| 循环 | 谁决定什么 | 边界 |
+| --- | --- | --- |
+| Worker 推理 ↔ 工具 | Worker 在任务范围内自主选择方法 | 不逐工具调用要求 controller 批准；重要发现、问题或范围限制再交互 |
+| Controller ↔ worker | Controller 将证据与 Goal 对照，给反馈并选择下一段有效工作 | 已准入工作内可以多次往返；一条反馈既不结算 Turn，也不自动授权新 attempt |
+| 跨 Turn 的受治理接续 | 既有 Core/runtime 验证原结算与新准入 | 模型提出工作；既有 [Turn loop 状态转移 owner](../../reference/protocols/turn-loop-controller-v0.md) 仍判断合法继续、等待与停止 |
+
+评估必须有内容：检查证据与未满足验收，决定沿有效路线继续、纠偏、补证或收尾；
+不能照单接受 worker 的完成声明，也不为了显示活动而强制改变策略。到受治理工作边界时，
+验证并结算原身份，下个 Turn 使用新准入。一段工作、一个 Todo、一次模型轮次或一份报告
+完成，都不等于整个 Goal 结束。真实依赖、用户操作、预算、停止或终态条件仍然有效；
+除此之外，有用且已获授权的工作不应停等用户说“继续”。
+
+这个逻辑循环由事件驱动，不是占住 controller 会话的阻塞等待。派发、观察、待评估结果与
+接续仍由各自既有 owner 持久化；结果或已记录唤醒到达后，由 host/runtime 恢复合格处理，
+不让模型空轮询。恢复时先核对原 attempt 以及未完成决策/effect，再继续，不能为了
+“重启循环”另派一个 worker。
+
+处理完用户/router 输入后，**从当前主循环待办重新选择**：可能先评估未读结果、补上反馈、
+派发已合格工作或结算，而不是无条件恢复旧汇报。汇报根据已有证据，在执行并行期间或
+主循环真实等待时择机做有界片段，既不阻塞主循环，也不要求每次往返都出一份报告。
+
+
+
+### Worker 执行期间的异步控制
+
+异步指 **worker 的长操作不占住 controller 的处理循环**，不是让同一个 controller
+会话并发写两条相互冲突的决策。派发先记录原 attempt，再返回可恢复的观察句柄；
+controller 不在持有会话锁或工作锁时等待 worker 整项完成。用户输入、router 请求和
+worker 事件通过既有有序入口唤醒短的 controller 处理轮次，按单元串行提交决策。
+Host 的等待/订阅可以持续，模型无需持续空轮询。适配器只能阻塞到整项工作结束时，
+应标为未支持异步 profile，不能拿“前端能收消息”冒充 controller 可交互。
+
+```mermaid
+sequenceDiagram
+ participant U as 用户
+ participant R as Router
+ participant C as Controller A
+ participant K as Core / 请求 owner
+ participant H as Host runtime
+ participant W as Worker A
+ R->>K: 发布有范围、原受众的请求
+ K-->>C: 原请求与当前工作依据
+ C->>K: 评估并申请工作准入
+ K-->>C: 原身份与允许范围
+ C->>H: 记录 attempt 后派发
+ H->>W: 任务与授权材料
+ H-->>C: 原 attempt 观察句柄
+ par Worker 持续执行
+ W->>W: 工具与实验
+ W-->>H: 进展 / 产物 / 问题
+ and Controller 仍处理交互
+ U->>C: 询问进展 / 修正要求
+ C->>K: 读取当前事实 / 保存修订
+ C-->>U: 有依据的答复及修订处理状态
+ R->>C: 另一个依赖或协调请求
+ C-->>R: 评估后的回应
+ end
+ C->>H: 可安全采用的纠偏，绑定原 attempt
+ H->>W: 受支持的 steer 或下个安全边界
+ W-->>C: 绑定版本的结果与证据
+ C->>C: 评估结果与未完成工作
+ opt 当前授权内仍有有价值的工作
+ C->>W: 经 Host 反馈并给出下一段工作
+ W-->>C: 后续发现与证据
+ end
+ C->>K: 到受治理边界时验证并按原身份结算
+ K-->>C: 返回主循环的新鲜继续决策
+ K-->>R: 既有返回路径的结果
+ R-->>U: 结论、产物与剩余缺口
+```
+
+图中用户与 router 的消息进入同一单元的持久有序 ingress，仅一个控制写入方；处理顺序
+遵循下方注意力与因果规则，不是无条件 FIFO，也不会生成两个 controller。
+只在查询需要新的语义解释时调用模型；已有状态可由 typed readback 直接展示。
+Worker 的事件先落到既有观察/journal，再触发处理；断线靠游标和状态对账恢复，不能
+依赖一次内存 callback。按工作身份去重，进度可以合并，未处理的取消、修订、结果和
+错误不能静默丢弃。队列满时返回可读的延后/不可用及恢复入口；限制与等待复用现有
+scheduler/ingress，具体容量随宿主验收，不另立消息总线。
+
+| 输入 | 当前工作能否继续 | 处理与回读 |
+| --- | --- | --- |
+| 查询 / 查看产物 | 是，查询不修改 attempt | 返回最近有证据的状态、版本与 unknown；不因询问重复派工 |
+| 范围内纠偏 | 按实际安全边界决定 | 持久化 revision；受支持 steer 后仍观察是否实际采用；不支持则排队至下一边界并明确告知 |
+| 改范围 / 改验收 / 冲突要求 | 依赖变化的工作需重新核验 | 请求带预期 revision，经原 owner 判断；冲突不靠“最后一句赢”或 router 优先级覆盖 |
+| Stop / 撤权 | 立即进入已有停止路径 | 不等 controller 模型或排在普通汇报后；分别回读请求记录、Host 中断与实际停止，未知效果继续对账 |
+| Worker 结果 / 迟到事件 | 恢复主循环评估，不无条件启动新执行 | 核对原请求、attempt、generation 与 revision；评估证据、反馈或在工作边界验证/结算，下个 Turn 使用新准入；迟到证据不能完成新任务 |
+
+```mermaid
+flowchart LR
+ I[输入已持久化] --> A[接收方评估]
+ A --> P[可采用：等待安全边界]
+ A --> D[延后 / 拒绝 / 冲突：返回理由]
+ P --> T[Host 已投递]
+ T --> O[后续工作证明采用]
+ O --> V[独立验证与原回执]
+```
+
+此图是证据阶段，不注册另一套状态枚举。实现映射到已有 request assessment、ingress、
+Host observation、验证和结算事实。**收到 ≠ 采用；投递 ≠ 执行；执行 ≠ 验收。**
+用户直达 controller 与经 router 转发的同一修订共用原请求/幂等身份；真正不同的请求
+保留各自身份，通过明确版本依赖协调，不用文本去重。跨单元没有隐含的全局消息顺序。
+
+
+
+### Controller 注意力：用户意图优先，在安全边界插队
+
+**默认注意力顺序：当前用户交互 → 已就绪的 controller—worker 主循环工作 → 普通 router 协调 → 主动汇报。**
+这是单元既有 ingress 内的选择，不新建全局任务 scheduler，也不覆盖 authority。
+要分清三件事：谁的意图约束工作、下一个合格输入先处理谁、当前操作能否让出。
+消息优先级高，不意味着自动取消 worker 或工具调用。
+
+| 输入 / 需要 | 注意力规则 | 边界 |
+| --- | --- | --- |
+| 已授权 Stop、撤权、强制预算/fence | 既有确定性控制路径独立于普通模型工作处理 | 由原 owner 记录、中断/对账；不能排在汇报生成后，也不等模型推断 Stop |
+| 当前用户指令、纠偏、提问 | 前台，先于自主协调和汇报 | 问进度不等于改方向；用户明确索要的报告是前台工作，与自主汇报不同 |
+| 主循环的派工、结果评估、反馈、继续与结算 | 其次；其中阻塞 worker 的交互优先，可打断后台内容生成 | 普通结果无需附带求助也应评估；普通进度/日志未改变决策则不唤醒模型；需要用户批准就升级，不能虚构批准 |
+| Router 自主协调与非阻塞 worker 信息 | 在前台与已就绪的主循环工作之后处理，延后有界 | 可验证的原用户请求经 router 转达，保留来源和依赖，不因经过管家而降级 |
+| 主动汇报与可选维护 | 合并后按有界片段择机处理 | 被打断后按当前事实更新，不逐条发送已经过时的草稿 |
+
+显式且适用的用户意图在当前权限/范围内优先于 worker/router 的自主计划；保留与新意图
+相容的旧要求，不能把一句新提问当作全部替换。选择依据是已认证来源、原请求/revision、
+当前依赖与实际阻塞事实，不能靠发送者自报“紧急”或材料中的关键词取得优先级。
+未分类输入做有界判断，不猜权限变化，也不静默丢弃。
+
+必要依赖可以临时继承正在等待的前台请求的注意力：回答用户必须先解决 worker 的问题，
+就先解除这个阻塞，作为服务用户的一部分。沿用原请求/依赖关系，仅提升这段解阻工作，
+不扩权，也不把 worker 整个队列升为最高级。必要的 router 依赖同理。发现依赖环或缺权限
+应暴露真实阻塞，不能无限提高优先级掩盖它。
+
+**有序 ingress 不等于所有输入严格按 FIFO 处理。** 到达和修订历史照常持久化；从因果上
+已可处理的 pending 输入中选择。同等注意力保持 FIFO，同一请求的 revision 依赖保留。
+新纠偏可以使旧草稿失效，但前序要求经既有 owner 记录为被替代，不擦除历史。取消可以
+立即使待派发工作失效，无需先执行完它前面的全部请求。仍只有一个 controller 提交决策，
+不能靠插队生成第二个控制写入方。
+
+插队具体分三种：
+
+1. **尚未开始的工作**：先选择高优先级且合格的输入，再生成尚未发送的汇报；原到达与
+ 处理事实保留，供恢复和回读。
+2. **纯草稿 / 模型推理**：在宿主支持的 native turn/tool 边界协作让出，或中断可取消的
+ 模型调用。保留简要意图和必要证据，不假设模型调用栈可原样恢复。先 fence 旧 invocation，
+ 再让另一次控制同一 session；迟到输出/工具提案不能发布或修改状态。恢复报告时按当前
+ 事实重新组织。
+3. **已准入工具/effect 或原子提交**：不能强拆事务，也不能从“模型已中断”推出回滚成功。
+ 新输入及时入账；原事务完成/恢复，或使用它实际支持的取消。适用的变化待处理时仅暂停
+ 依赖它的新 effect，独立已准入工作保留原范围；后续派发/发布前重新核验 revision。
+
+因此“打断汇报”通常是打断 controller 的内容组织，**不重启或取消业务 worker**。
+若汇报已经发送或投递结果不明，先恢复原发送操作再重试；已被观察的内容不能假装不存在，
+部分流式内容不能标作完整报告。已经送达却过时的材料，由既有版本/返回 owner 更新。
+Host 不支持可靠中断时，应限制 controller 的单次片段并显示实际等待；不能并发调用
+同一个 native controller session，也不能把不可中断的长报告宣称为及时响应。
+
+```mermaid
+sequenceDiagram
+ participant U as 用户
+ participant I as 既有 ingress / runtime
+ participant C as Controller
+ participant W as Worker
+ C->>W: 经 runtime 派发已准入工作
+ W->>W: 自主执行
+ W->>I: 普通结果与证据，没有求助
+ I-->>C: 恢复主循环评估
+ C->>C: 对照证据与剩余验收
+ C->>W: 反馈并推进当前授权内的后续工作
+ Note over C,W: Worker 继续，controller 同时处理输入
+ U->>I: 修正一项要求
+ I-->>C: 用户输入先于普通管家/汇报工作
+ C->>C: 判断 revision 与依赖工作
+ C-->>U: 说明采用或真实等待边界
+ C->>W: 在安全边界应用合格纠偏
+ W->>I: 后续证据
+ I-->>C: 重新选择主循环待办
+ C->>C: 评估、继续或经既有 Core 收尾
+ opt 汇报已适合处理
+ C-->>U: 更新后的有据汇报
+ end
+```
+
+同时防止饿死与反复打断。相容的用户纠偏可以合批，但保留各自身份；可替代的进度可以
+合并，问题、错误、结果、结算/恢复义务必须保留。限制每段前台服务工作，给仍有效的主循环
+工作与应返回结果保留处理机会；等待时间可提升这些义务的服务顺序，但不覆盖 Stop、显式
+取消或用户意图。可选旧汇报允许被替代。输入长期超过容量时，展示背压/延后与真实阻塞，
+不承诺做不到的时延。不要每次输入一个字就打断正在回答用户的调用，也不让用户调优先级
+数字。既有 quota/停止规则仍约束执行，浪费及被中断的模型调用都计入完整成本。
+
+MVP 在一个真实 Host 验证自主主循环、稳定选择与**后台内容生成的让出**，不做任意工具任务抢占。
+来源、依赖、invocation fence 缺在哪里，就在既有 ingress/request/session owner 中补；
+typed owner 选择可处理输入并保护提交，controller 判断语义。App/CLI 与受支持 Lark
+区分已收、处理中、延后/阻塞、实际采用，无需增加优先级控制台。规则属于可选单元 profile，
+不能静默重排现有单会话 chat 队列。C3/C6/C8 承接实现及下方注意力验收，仅写进 prompt
+不算实现。
+
+
+
+### 故障隔离：会话丢失不等于工作丢失
+
+```mermaid
+sequenceDiagram
+ participant R as Router
+ participant C as Controller A
+ participant K as Core / 原 journal
+ participant H as Host / Worker A
+ C->>K: 记录原派发 intent
+ C->>H: 启动原 attempt
+ Note over C: Controller 退出或失联
+ H->>H: 仅在原授权、预算和边界内继续
+ R->>K: 查询单元状态，不新建替代 worker
+ Note over C: Controller 恢复，新控制 generation
+ C->>K: 恢复待处理输入、attempt 与原回执
+ C->>H: 观察原 attempt / 取回原结果
+ H-->>C: 运行 / 完成 / 未知
+ C->>K: 复核当前权限，继续对账或结算
+```
+
+Router 不可用时，已准入单元不因汇总渠道掉线而停工；直接交互仍受原受众授权约束。
+Controller 不可用时，worker 只可继续原授权的有界工作；需要新批准、范围变化或新的
+dispatch 时等待恢复。接替 controller 必须围栏旧控制 generation，但不能把仍有效的
+worker attempt 自动当成孤儿重跑。未知是否执行的外部效果保持未知，不能由超时推导
+安全重试。Core/Host 的 Stop 与预算限制不依赖两个模型中的任何一个在线。
+
+多接收方请求不是跨 Goal 原子事务。A 已接受、B 拒绝时，router 展示部分结果，决定
+补充请求、调整依赖或请求用户决策；不抹掉 A 的真实效果。跨单元转交产物保留版本、
+出处、权限与独立验收，不广播完整私有上下文。单元重绑定或 profile 回退时先关新准入，
+核对/停止原 attempt 与未决 effect，再以新的合格绑定继续。
+
### 归属与统一契约
-```text
-Core owners <-> unified governed work contract <-> controller session
- |
- task / findings / artifacts
- |
- executor session
- |
- scoped host tools
-
-Host adapter 执行 dispatch、session fence、中断与传输。
-Core owner 校验操作，提交既有 effect/settlement 回执。
+```mermaid
+flowchart TB
+ D[既有领域 owner 的当前决策] --> C[一次语义组合]
+ C --> S[完整不可变 capture]
+ S --> P[Progressive / full / delta 交付]
+ P --> M[Controller 或合格单会话消费者]
+ M --> O[显式 typed 操作]
+ O --> V[Core 校验与原回执]
```
复用 TypeScript interaction/work-context 与 effect owner。组合 owner 一次捕获它们的
@@ -261,7 +553,7 @@ Executor 摘要不能重建缺失的控制义务。必需材料矛盾或不可
### 执行期间的人机交互
在受支持的双会话 profile 中，executor 活动不能阻塞 controller 面向用户的对话。
-复用既有按角色绑定的有序队列、版本化请求、host 观察和原受众返回路径。询问或汇报
+在既有队列机制上补齐按角色绑定，复用版本化请求、host 观察和原受众返回路径。询问或汇报
不启动第二个业务 executor，不无故中断已授权 attempt，也不产生另一次 Turn 扣额。
| 用户结果 | 必需行为与证据 |
@@ -350,7 +642,8 @@ role 不是第二个并发业务 executor。Peer 或并行执行仍需既有独
3. Dispatch 前，host 绑定 work/request revision、attempt、session role、generation、
范围与预算；调用 executor 前记录 intent。
4. Executor 工作并返回观察/产物。Readback 区分投递、执行、结果可用、独立验证与已接受
- 写回。多次交流不产生多次 quota 扣除。
+ 写回。Controller 沿[执行主循环](#controller-worker-main-loop)评估普通结果并反馈，不只
+ 响应阻塞。多次交流不产生多次 quota 扣除。
5. Controller 提议接受或修改；既有 effect owner 校验并对原 Turn 结算一次。后续新鲜
决策继续可执行工作、按记录的事件/时间等待或停止。
@@ -363,178 +656,14 @@ role 不是第二个并发业务 executor。Peer 或并行执行仍需既有独
| 工具执行中 Stop | Host 在受支持范围内中断；分别报告 ACK 与真实退出。保留未知/执行中 effect；停止回执不能证明物理回滚 |
| Controller 不可用 | 既有 host/Core 停止与预算机制仍有效；暂停依赖工作并恢复，不能让 executor 临时成为 Core owner |
-### 差分上下文
-
-复用现有 context-delivery owner 与不可变 capture 机制。目标包含两个正交层，
-二者都不创建第二个语义 producer：
-
-- **Layer 1 — Progressive：** 面向模型的交付默认跨 LoopX Host 生效，包括没有
- Session Hooks 的普通 CLI、MCP/HTTP 和外部 worker。当前 Goal、适用的累计验收、
- 失败/未知、权限、停止条件和未履行读取/结算义务保持内联。历史、来源正文和评审证据
- 等重材料，只能经既有 typed composition owner 折叠，提供精确的当前 capture 读取
- 路线，并明确依赖工作前的读取义务。相关性/schema 未知时保留完整必要材料。这是
- 交付默认值，不授予额外采集或持久化权限。调用方没有可用且获授权的 reader 时交付
- 完整内联上下文；本地文件路径不是可用的远端读取路线。Host 硬限制使两种路线都不可用
- 时，明确上下文不可用并阻止依赖工作。
-- **Layer 2 — Delta：** 对组合后实例进行精确编码，仅在 consumer/session、role、
- epoch、schema 与来源绑定已资格化的 Host 自动选择。Progressive 可以用 full 编码，
- 完整内联实例也可以用 Delta；连同 Progressive + Delta、二者都关闭，共同验收四种
- 组合。Host 没有合格连续性时，对 Layer 1 使用当前 full 编码，不丢失 Progressive，
- 也不虚构 native session。
-
-区分两种已有复用主张。**`captured_file`** 比较已验证且兼容的不可变落盘产物；
-精确重建不要求模型先读旧文件、到达 EOF 或保留其内容。**已保留模型输入的复用**
-只有在精确 consumer binding 下存在可信完整送达和 retention 证据时，才能省略此前
-交付的正文。文件落盘、工具输出回执和模型自我确认不能建立这种证据。Session Hooks
-只观察受支持边界，不授予新权限。保留删除、数组顺序、null、空值、原始数值和完整
-字符串；未知字段在注册复用语义前保持完整。先发布当前完整恢复源，再交付可选视图或
-差分；验证重建，Delta 加元数据不更小时选 full。Layer 1 也将最终序列化 UTF-8 视图、
-读取说明和索引，与同次 capture 的完整替代交付对比；选择更小的有效交付，不能为满足
-体积预算而裁掉必需含义。
-
-当前权限、准入、取消、未完成必读、结算与 scheduler 事实即使未变也新鲜内联交付，温态
-传输不能减弱正文义务。Delta 缺失/乱序、基线损坏或未知时，选择当前 full 编码/恢复；
-读取截断或丢失时，从同次 capture 恢复必要范围。上下文压缩使下个工作 Turn 在新基线
-epoch 中的 retention 失效；它不使现有 Turn 失效，也不要求预读旧包或立即全量重读。
-保留原准入、恢复引用和一次结算/扣额。执行仍检查来源有效性与当前权限；恢复旧 capture
-不能复活已取消工作。Executor 任务对话独立消费语义材料，不是 controller Core packet
-换名后的 delta。
-
-#### 跨 Turn 未读材料
-
-当前不可变 capture 已支持精确选读。待补设计是跨交付显式发现未读材料，不是第二个
-reader，也不是先读完整基线。扩展既有 context/readback owner 与原生 `session.json`
-投影；其他 Host 使用相应 consumer binding。区分产物发布、模型可见交付覆盖、
-retention，以及语义采用/验收成果。
-
-`confirmed_read_sections` 是提议的覆盖投影；若保留 `consumed_pointers` 这个名字，
-它必须从同一 owner 派生，不能成为第二本台账或暗示理解。证据绑定精确 source/capture
-digest、revision、consumer/session role、epoch、schema 和选读 pointer/range。
-仅凭可信 Host 对实际模型可见结果的观察确认覆盖。调用 `--select`、文件存在、reader
-EOF、成功工具日志或模型自我 ACK 均不足。部分/截断/丢失输出保持未确认；选择父节点/
-索引不能确认隐藏子节点。没有此类 observer 时覆盖为未知，发现保持保守。这种覆盖
-绝不能成为 `captured_file` Delta 的新增全量读取门。
-
-每次 warm 交付携带 **`unread_context_index`**（提议名称）：列出符合交付范围、未内联且
-当前内容未确认或已变更的材料，包括被 Delta 省略的未变正文。给出精确当前指针、来源
-版本/digest 和必读状态，不能凭摘要推断相关性。已确认范围只适用于观察到的版本；
-内容变化、数组重排或映射不明须重新绑定当前来源并保守发现。确认送达不证明输入已保留
-或语义已采用。
-
-每项通过既有 `quota context-read --select`，绑定精确 capture SHA，从**当前完整不可变
-`projection.json`** 独立读取，不依赖上一包、基线文件、模型记忆或 patch 链。派生的
-`required-context.json` 或 wire 视图保留既有 owner 对规范来源的显式映射，不能混用
-根路径和 digest。历史精确版本回查仍属于单独绑定版本的产物/读取契约，不能虚构路径
-别名或借此静默使用旧事实。前轮材料仍属必需却不在新 projection 中时，由原 owner
-带入当前 capture，或暴露当前获授权的来源/读取义务。合法过期、撤权或移除须显式保留；
-必需材料不可用则阻止依赖工作，不能静默记作已读或永久保留禁止保存的原始数据。
-外部材料仍遵循自己的来源消费契约。
-
-#### 配置与迁移
-
-下表是提议行为，不改变当前限定 Codex 的 `context_delivery` on/off 接口。演进既有
-typed 配置 owner，表达两个层的决定；由 C1 在实现前映射精确名称和版本，不新增平行
-配置存储或 packet 格式开关。
-
-| 配置 / 调用方 | 迁移与生效行为 |
-| --- | --- |
-| 面向模型、没有持久偏好的调用方 | 该调用方 reader/回退及成本验收后使用目标 Layer 1 默认值；Layer 2 仅在连续性已资格化的 Host auto，否则 full 编码。在 rollout 合格前，普通 CLI/其他 Host 仍保持当前 full 行为。 |
-| 显式调用参数/环境 off | 保留当前优先级，本次调用 full/raw 交付，不依赖可选 codec/覆盖台账，不改写持久偏好。 |
-| 已持久化 off | 保留完整 off 路径及原读取/恢复义务，不能借“无偏好”迁移把它变为 Progressive 或 Delta。 |
-| 已有 on、受支持 Host | 映射为 Layer 1 + 已资格化 Layer 2 auto 时，保留合格的原生文件/恢复语义，不增加模型全量读取前置。 |
-| 已有显式 on、不受支持 Host | 兼容期间保留当前校验错误；按版本发布且调用方验收后才可提供受支持的 Layer 1，不能静默重释不受支持请求。 |
-| 新的独立分层配置 | 独立遵守各层，包括 Progressive off + 合格 Delta auto；显式 Delta off 仍保留 Progressive；不受支持的 auto 回退当前 full 编码。 |
-| 内部 raw machine 消费者 | 保留显式 `--context-delivery off` 契约，不把机器 JSON 换为模型文件引用，不修改偏好。 |
-
-冻结已记录版本、实验配置与历史回执。扩大默认值属于行为变更，须验证真实调用方、
-显式 off 隔离与失败/恢复；设计合并本身不改变默认值。
-
-#### 交付验收
+
+
+
+
-复用 C1/C2 真实入口和第 9 节对照，覆盖以下决定性案例：
+### 差分上下文
-| 案例 | 必须观察到的结果 |
-| --- | --- |
-| 无 Hook 普通 CLI 及受支持 MCP/HTTP/worker 路线 | Layer 1 经真实获授权 reader 或完整内联回退可用，不留下仅本地可用的悬空引用，不虚构 native epoch。 |
-| 未变的未读末尾在下一 Turn 成为决定性约束 | Warm Delta 可省略其字节，但当前索引须暴露完整来源，后续实际选择/工作遵守恢复的约束；仅索引可见不能算成功。 |
-| 变化/未读正文、数组重排、未知字段或 scope | 绑定当前来源，保留适用跨 Agent 义务及未知范围的完整回退。 |
-| 部分页、工具输出丢失/截断、EOF 但无 Host 见证 | 不确认不可见字节或隐藏子节点；恢复缺失范围，未知覆盖保守进入索引，文件 Delta 仍可用。 |
-| 压缩、role/session/schema/epoch 变化 | 使不兼容 retention/复用失效；恢复当前事实，不重放原准入、effect 或扣额，不预读旧包。 |
-| 来源撤权、reader 不可用、材料合法移除 | 遵守当前权限/来源 owner，暴露丢失并阻止依赖工作，或使用获授权完整回退，不泄露旧数据。 |
-| Full 更便宜、off 与旧配置 | 选择有效 full 交付，保留显式 off 和冻结版本，并观察来源身份及 raw machine 消费者行为一致。 |
-
-正文文件缩减率主指标为 **`1 - V/F`**：`F` 是完整 capture 的实际 UTF-8 文件字节，
-`V` 是同次 capture 所选视图正文文件的实际字节，节省字节为 `F - V`。绑定两个产物及
-digest，wire/索引开销单独报告，不能改换分母；上文交付体积保护仍计入实际呈现开销。
-净收益主张还须计入后续全部读取/恢复、Host/controller/executor 调用与延迟、实际
-tokenizer/cached/output 用量、人工注意力和验收成果。保留不利案例和冻结预算。
-包更小本身不能证明 token 成本更低或成果更好；第 9 节原 quota 单会话对照仍为主，
-双会话成本单独比较。
-
-### 按决策阶段交付候选上下文
-
-Canonical capture 保留完整候选上下文，由同一 C1/C2 owner 按消费者实际要做的决策
-交付。本节提出替换契约，不允许跳过已有必读项。当前 capability gate 将选择交给
-Agent；`selected_todo` 投影或列表顺序本身不能证明比较已经完成。在消费者与恢复义务
-一起替换前，保留 [#7557](https://github.com/loopx-project/loopx/pull/7557) 的完整
-上下文修复。
-
-| 决策阶段 | 依赖决策前必须取得的输入 |
-| --- | --- |
-| 选工作或重新考虑选择 | 完整、可发现的候选索引：身份/版本、原目标、已声明的 Goal 贡献、优先级、资格、归属、依赖/阻塞、当前证据/不确定性和同次捕获详情引用。缺失事实保持未知。比较备选项前读其完整详情；索引不能判明某项是否相关时，先展开再选择。不能静默只保留 top-K。 |
-| 继续已准入工作 | 完整当前任务、原始和累计要求、适用的全局/共享约束、依赖、反证、当前权限与停止条件。注册的继续执行契约可延后独立备选项，同时暴露可能触发重新考虑的新资格/资格变化和证据。仍被要求在全部 runnable 候选中选择的 Agent，依然处于选择阶段。 |
-| 重规划或验收 Goal | 展开全部受影响工作与验收，包括跨 Agent 依赖和冲突证据。范围未知时展开完整捕获依据；归属和之前的局部完成不能证明无关。 |
-
-这些是消费者义务，不是三套 packet schema 或新 scheduler mode。Typed owner 按明确
-契约决定哪些读取可延后，Agent/controller 负责语义选择。作者提供的目的或风险摘要
-帮助发现，不能证明省略正文无关。不按关键词、领取标签或模型评分推断相关性。缺少充分
-typed 事实时，比较仍可能需要所有正文；冷态选择不承诺压缩比例。普通工作默认展开当前
-Agent 的 outcomes、让其他成果可发现是有用的；共享要求、依赖、冲突证据和未知关系
-必须突破默认范围。Outcome scope 与候选选择保留各自 owner。
-
-扩展既有不可变 reader，从**同次 capture** 批量读取所选详情，保留各请求项的版本、
-来源、完整性、覆盖与游标。同 Todo 不同版本仍分开。详情缺失、截断、不受支持或变化时
-阻止依赖工作，使用该 capture 的完整恢复；fresh guard 不能充当详情 reader。一次
-读取可交付多个正文，受支持的保留会话内无需重复交付已验证正文。读索引不等于确认隐藏
-正文已读。已保留模型输入的复用仅覆盖实际送达且保留于该消费者的正文；文件 Delta
-遵循上文独立产物证明。新成为必需的详情必须提供正文，不能因为机器已经存有它而省略。
-上下文丢失恢复必需模型产物，范围未知时扩大到完整来源。
-历史 capture 保留原义务。读取回执证明覆盖，不证明理解、保留、新鲜权限或验收。
-
-单会话 Agent 消费同一管线。Controller/executor profile 中，由 controller 比较备选项
-并承担 Core 记账；executor 经既有 host 通道取得完整当前工作与授权材料。它不会成为
-Core 客户端，也不用接收全部备选项来弥补 brief 的缺失。复用 capability 资格、
-work-context/读取履行、capture/detail 与 delta owner，不新增候选存储、Python
-相关性规则或逐项审批往返。
-
-在相同输入上，与原 quota 单会话和修正后的完整上下文对照。覆盖：初始未展开候选末尾
-的决定性约束、展示上限之外的有价值备选项、peer 证据变化、阻塞项变为可执行、同标题
-不同要求、缺失元数据、上下文丢失及批读失败。实际选择与后续已验证工作必须遵守约束；
-可重建 JSON 或 selected ID 不变不足以通过。计入从首轮输入到验收成果的全部详情读取、
-分页、重试、恢复、两个会话的调用、延迟和人工介入；保留分阶段交付更昂贵的小任务与
-冷态选择反例。字节与使用真实模型 tokenizer 测得的 token 分开报告。
-
-交付仍归 C1/C2：先由真实 caller 验证共享同 capture reader 与必读恢复，再将该 caller
-的阶段交付和义务一起替换，最后验证 retained delta 与可比成果/完整成本。复用
-[#7560](https://github.com/loopx-project/loopx/pull/7560) 的 outcome scope 工作，
-不能将 outcome 关系当成候选选择证明。
-[#7587](https://github.com/loopx-project/loopx/pull/7587) 的诊断计数折叠是独立兼容
-切片，不代表本次替换。每个切片可有独立 PR 与回退，不要求通用检索框架或启用双会话。
-
-原生 quota caller 现已实现有界的验收材料切片：已知的累计目标、完整验收要求描述和
-当前评审状态保留在必读视图；来源历史与评审说明/证据可以从原始不可变 capture 按需
-读取。读取义务、全量/差分基线与恢复共同切换。选读详情不能履行隐藏的必读内容，
-也不能建立完整基线。未知语义和签名 envelope 保持完整，关闭路径不变。Typed 路径
-计划不让原始 capture 数值经过 JavaScript 往返转换。
-若必读视图加详情索引的 UTF-8 序列化字节数并未减少，则保留全量交付和原始义务。
-默认详情示例选择来源、说明或证据字段，避免重放整个 outcome。
-
-原生 exec 与 code-mode fixture 还验证了同一工作 Turn 内连续两次压缩：充分的工作
-摘要可以保留原始工作/结算身份继续推进，无须重放 packet 或重新准入。基线仍失效；
-尚未完成的初次读取和缺失的必要事实仍需从同一 capture 恢复，新工作 Turn 则取得
-新的 guard。这是确定性 inference 下的原生协议资格，不是模型遵循性或真实成果/
-成本收益的证据。C1/C2 仍未完成：候选、偏好、Explore 分阶段交付、签名 envelope
-迁移，以及可比验收成果和完整成本仍须分别验证。
+完整字段、消费者与验证细节见[契约与上下文迁移附录](controller-executor-unified-contract-v0/contract-and-context.zh-CN.md#差分上下文)。
## 6. 备选方案与取舍
@@ -546,6 +675,24 @@ work-context/读取履行、capture/detail 与 delta owner，不新增候选存
| 始终使用双会话 | 拒绝：controller 成本、延迟和交接损失可能超过收益；保留合格单会话 profile |
| 一个万能 runtime/effect executor | 拒绝：host、scheduler、事务与 provider 权限不同；共享语义与回执，不共享执行所有权 |
+### 外部实践如何影响这个设计
+
+2026-11-06 阅读以下原始资料，采用其机制启发，不引入运行依赖，也不借用外部指标
+证明 LoopX 收益：
+
+| 原始资料 | 对本 RFC 的启发 | 不直接迁移的部分 |
+| --- | --- | --- |
+| [Anthropic：多 Agent 研究系统](https://www.anthropic.com/research/multi-agent-research-system)，2025-06-13 | 独立上下文和任务交接适合可分解的长任务；需把额外协调和 token 纳入价值比较 | 研究任务的并行收益不证明代码任务或双会话一定更省；因此保留单会话、小任务反例和完整成本对照 |
+| [Temporal：Workflow message passing](https://docs.temporal.io/encyclopedia/workflow-message-passing) | 区分查询、异步输入与有处理结果的变更；把“消息已收”与“请求已处理”分开观察 | 不引入 Temporal/另一套 workflow engine，也不把 Signal 语义等同于 LoopX 验收回执 |
+| [Kubernetes：Controllers](https://kubernetes.io/docs/concepts/architecture/controller/) | 观察持久事实、提出行动、再核对实际状态；重启后对账而非盲重放 | LoopX controller 有模型判断，业务工作并非都可幂等重做；确定性准入和 Host 执行仍有各自 owner |
+| [Akka：Mailboxes](https://doc.akka.io/libraries/akka-core/current/typed/mailboxes.html) 与 [Actor 顺序处理](https://doc.akka.io/libraries/akka-core/current/typed/actors.html) | 有优先级的邮箱仍可保持同级 FIFO，单一消费者保护状态；队列顺序与正在执行的处理是两个边界 | 不引入 Akka；不把邮箱优先级当作抢占模型/工具的保证，也不采用满队列静默丢消息的行为 |
+| [A2A：Life of a Task](https://a2a-protocol.org/dev/topics/life-of-a-task/)（开发版） | 区分对话上下文、消息、任务和版本化产物，避免把每条消息都变成新工作 | 不直接复制其状态枚举或终态规则；LoopX 继续使用现有请求、工作与 effect 身份。协议适配另行资格化 |
+
+异步 handler 还需处理在等待点交错的状态变化；[Temporal 的 TS 消息处理说明](https://docs.temporal.io/develop/typescript/workflows/message-passing)提供并发协调的参考。这里采用单一控制提交与版本复核，不借此假设模型调用或外部 effect 可抢占。
+
+因此本提案选择“有身份的异步交互 + 现有 Core 对账”，不是“所有事情都增加一层 Agent”。
+三层拓扑是否优于现有单会话，需要第 11 节的真实成果与成本证据来回答。
+
## 7. 安全、隐私与兼容性
Controller 判断不授予额外权限。运行时凭据与 Core 写能力对 executor 不可访问；按
@@ -559,187 +706,11 @@ capture/回执保留原版本/签名与 replay 身份，不能改写成新 schem
## 8. 迁移与回退
-### C1 wire 布局建议
+
-目标是吸收 quota packet 的必要信息量优势与 TurnEnvelope 的效率优势，一起替换
-二者。“完整”指必要语义完整，不表示今天 packet 中所有重复诊断都永久内联。下述
-保留根路径的无损候选只是迁移对照，用于在消费者迁移时发现遗漏与引用断裂；给它改名
-或转发全部旧字段，均不能满足最终设计。
-
-逐字段、逐条指令盘点所属规则与实际消费者。在依赖它的决策之前，必须具备当前任务、
-原需求及修订、相关证据、权限、必读、执行/停止条件和原结算义务。通过 typed owner
-识别并消除已证实的重复表达与无关诊断噪声。稳定材料只有在保留证据已验证，或来源
-可解析且绑定完整性、读取顺序明确时，才可引用或差分交付；缺失上下文须先恢复再执行
-依赖工作。引用本身不证明模型收到了约束。不能凭正文启发式把未知字段当成可选或静默删除。
+### C1 wire 布局建议
-在同一规范契约内吸收 envelope 的有效特性：清晰的执行身份与动作组织、单一机器
-binding、减少重复指令、有界交付与可靠详情/恢复。Full/delta/detail 是同一实例的
-编码，不是永久并存的不同语义视图。原始来源证据保留在既有 owner，不再输出第二份
-可执行 packet。最终布局可在引用映射、消费者迁移与实测收益成立时调整；保留根路径
-不是不可更改的产品约束。
-
-| 来源或关注点 | 候选映射与资格要求 |
-| --- | --- |
-| 迁移中的当前 decision 字段 | 无损对照保留路径和值；最终映射前枚举各模式，区分必要语义、已证实重复与纯诊断材料，不能凭某次 packet 推断可选性。 |
-| Work context、必读与结算 | 保留既有 `interaction_contract` 路径与 owner。现有根相对引用保持含义；有意搬迁须显式迁移引用与 reader，不能按模式改写正文或命令字符串。 |
-| Host-operation binding | 从真实调用方 execution context 组合，验证与源权限一致；binding 冲突时拒绝，不能选择方便的表示。 |
-| 内容与传输完整性 | 对整个语义实例作完整性承诺，独立于原紧凑 action digest。精确 capture 字节校验和原结算身份仍分别检查；更换传输编码不创建新 effect。 |
-| 完整 capture 与 Progressive 视图 | 区分规范 `projection.json` 与派生 `required-context.json`/wire 视图，盘点精确根路径、版本、digest 和指针映射；先保存完整恢复源，再交付呈现，仅通过可用且获授权 reader 引用。 |
-| 文件复用、交付覆盖与 retention | 分别盘点既有 typed owner 及证据边界。提议的 `confirmed_read_sections`/派生 `consumed_pointers` 只表示观察到的覆盖，不是产物重建证明、理解或文件 Delta 全读前置。 |
-| 未读发现 | 将提议 `unread_context_index` 映射到当前完整 capture 的指针、版本和来源/读取义务，包括未变的未确认材料；变化/未知映射重新绑定，保留显式不可用状态和权限检查。 |
-| 历史回执与 reader | 未结工作按记录版本解码。临时内部 adapter 可以服务既有效果解释器，但不能成为第二份输出契约，也不能用紧凑副本替代模型必需输入。 |
-
-一个合成布局探针使用真实隔离 File/SQLite quota capture 和既有 TypeScript context
-codec。保留源路径时可使用 warm delta；将全部事实搬至新 `facts` key、同时沿用旧
-`quota_packet` surface 时，以 `delta_not_smaller` 回退 full。两种布局均精确重建，
-epoch 变化均要求 full。Retention 为合成声明；这衡量 codec 行为，不证明宿主观察、
-模型理解或成果/成本收益。它排除的是**沿用旧 surface 却未映射的根路径搬迁**，不是
-一般性的嵌套布局。若映射与消费者收益足以抵偿迁移成本，仍可设计嵌套布局。
-
-因此 C1/C2 须随 wire 迁移显式版本化 context surface 及其 fresh/reuse 路径，不能
-改名冒用旧 surface 或凭 Turn 身份继承基线。迁移时先保存兼容的完整来源，面向模型
-视图可以已使用 Progressive；复用须具备上文相应的文件产物或 retained-model 证明。
-资格覆盖旧 action 投影之外的字段、基线缺失、
-session/epoch 变化和同 capture 恢复。这里消除了具体布局风险；下一步仍是共享 writer
-与最终消费者替换，不能再建设一个布局框架，也不能据此宣布 C1 交付。
-
-尚未完成的实现候选 [#7430](https://github.com/loopx-project/loopx/pull/7430) 已在既有
-TypeScript owner 中、quota 与原生 Turn 捕获之前组合完整来源，并传入实际 Codex
-stdin。隔离 File/SQLite 的真实 CLI 加合成可执行程序覆盖来源完整性、失败 attempt
-恢复与一次结算。这推进了两个 writer 和最终输入替换，尚未取得 C1 切换资格。
-候选现已通过规范 CLI channel 路由能力重入，并在完整契约的 Codex 输入中保留原始
-hash 绑定的 review/writeback reader。合成 File/SQLite 执行验证了新 obligation 绑定
-和原 Todo 绑定 replan 的材料读取。原生启动现只从已记录的结算身份取得唯一因果
-绑定，观察到的语义 replan obligation 不得替换原 Todo 绑定。源 quota 与健康拒绝
-仍阻止宿主启动。Release fixture 现只导入一次最终来源；这些可执行检查不代表真实
-模型或已安装宿主验收。结构化宿主 renderer 现与 Codex 共享完整输入传输及原 hash
-绑定的材料读取器。实际隔离 File/SQLite Turn→DSH runner 接收同一捕获来源；历史
-请求 prompt 正文保持精确一致。结构化 DSH 仍使用 Todo 范围的 session：只有
-obligation 的 replan 在派发前被拒绝，不伪造 Todo 绑定。完整来源有意保留未激活能力的
-配置和诊断事实；这些事实不会激活 recall 指令或 reflection 结果字段。这是已披露的
-展示变化，激活边界与历史等价分开验证。
-Markdown quota 入口现渲染同一份完整契约，不再另外挑选事实子集。真实 File/SQLite
-CLI 捕获验证普通入口与原 envelope flag 均保留全部字段和指令，JSON 类型与任意
-来源正文经过渲染后不丢失。外部 worker 的 File/SQLite 准入、未决 attempt 恢复和
-重启检查已通过完整 producer 输出；但不透明 shell wake 仍不能证明该原始契约已
-交付 executor 模型。
-真实 benchmark checkpoint preflight 已验证 File/SQLite、replan/非 replan 及
-context delivery 开关组合下的完整来源相等；可选 full recovery 保留同一来源，初始
-准入只有一次，reader 不写状态。这只证明契约传到 checkpoint 的模型输入文件，
-不代表原生 session 捕获或 benchmark/模型成果。此前只要外层 source hash 相符，
-`replan-view` 就会接受不支持的版本或无效的内部绑定；现在复用既有完整契约 validator，
-未版本化的历史读取保留原解码器。
-successor 写入指引现已在完整 capture 前绑定到已决定的 Turn，复用历史 staged
-读取的同一格式化 owner。完整契约包含原 Turn/Goal 绑定，以及结束前完成创建回执
-所返原结算、不得执行 successor 的义务；后续现代材料读取不再追加第二次绑定。
-真实 File/SQLite 的 App heartbeat 和 generic CLI 测试从该内联契约创建 successor，
-拒绝过早 spend，原身份只结算一次并保持 successor open，不依赖再次 guard 或
-staged reader。这改变了完整输入的 successor 指引；未版本化历史读取保持原行为。
-仅结算、capability intent、未绑定和 context 不匹配的输入保留原写入指引。
-checkpoint 的旧 reader 测试本身不能证明这条生命周期。剩余材料 reader 退役及
-其他 C1 消费者不能为满足历史断言而恢复第二份精简可执行事实视图。
-完整契约边界现复用既有 decision/frontier 词表，在 capture 前与后续读取时拒绝未知、
-空值或类型错误的根执行 action；hash 合法不能证明消费者理解未知执行语义。可选证据
-仍完整保留，包括陌生版本和形似 action 的字段名；未版本化历史 action 路由不变。
-这只验证根 action 边界，不代表所有必需语义字段均已验收。真实 File/SQLite 原生 CLI
-的 producer 故障在 capture、派发与 spend 前被拒绝；前一候选会到达更晚的启动拒绝，
-这些探针不证明此前存在无保护执行。Selected-work 测试现读取
-完整 interaction context，并通过真实原生 `turn plan` 入口验证宿主输入。真实
-File/SQLite 检查保留完整任务正文、规范 note、作用域 gate、需求新鲜读取及来源丢失
-恢复，不把 App capture 换绑到原生宿主。此前六项旧根布局断言失败仍作为历史失败
-保留；它们后续的语义检查现在已实际执行。
-此前六项 staged-reader 失败作为历史证据保留。完整 composer 现于 capture 前
-复用 Explore 既有可用性修正：已证明没有 Todo 的 pure replan 不再展示必须绑定
-Todo 的结果附件写法。证据、独立图命令与全部工作前义务保留；陌生/自定义指令及
-歧义绑定保持原文。有 Todo 的可用附件写法仍完整内联。这是可用性修正，不改变
-权限，也不新增精简事实视图。真实 File/SQLite 原生宿主输入覆盖两种绑定。
-Staged 测试现消费完整 CLI 输入，并对同一不可变 capture 运行历史材料 reader
-codec，覆盖恶意 PATH、不可用 registry、身份/验收篡改及实际 writer。测试比较
-全部 successor 绑定指令，不再排除完整输入已拥有的字段。附件拒绝 fixture 提供
-合法、显式的 finding status，确保实际到达缺少 Todo 的身份门。23 项 staged
-检查与四项原生宿主用例通过；这些相互重叠的范围不能证明全部消费者退役或打包
-宿主资格。
-原生 context fixture 现将两种 CLI 写法都绑定到 `complete_turn`，并将重建后的
-全部事实与原始 capture 比较。首次四项失败源于恢复 oracle 仍使用旧 surface；
-Unix rendezvous 检查此前只比较内容，允许 full 回退掩盖同一错配。修正后要求
-原 target 和实际 delta 模式。十项用例通过真实 Codex exec/app-server/code-mode
-及 worker resume，使用隔离 SQLite 与确定性本地回环响应，覆盖压缩、进程恢复、
-历史文件替换和未合格 replay profile。未调用付费模型或启动 benchmark 实验。
-当前完整 quota-settlement CLI 模块 158 项通过，包含历史 cache parity 用例；
-此前间歇性错配的原因尚未证明，不能改写为历史通过。
-File/SQLite context→DSH 子进程检查现使用完整 capture 和生产 request builder，
-不再把当前 CLI 响应当作旧 action projection。普通 capability 开/关输入保留全部
-来源事实；已绑定 replan 使用生产 capture binder，并执行实际交付的原证据 reader。
-来源事实、schema 版本或 replan 义务被修改时，在 runner 接缝前拒绝；显式历史引用
-reader 覆盖仍保留。八项聚焦用例通过，使用注入的记录 runner，未调用真实 DSH 模型；
-本次测试迁移没有修改 runtime 代码。
-完整契约边界现进一步复用既有 interaction decoder，校验必需版本、channel 类型、
-通知策略和执行一致性。四种非法语义原先能通过组合；现在即使 producer 提供正确
-完整性哈希也会拒绝。保留原对象及未知可选事实，不用 decoder 规范化输出替换原文。
-File/SQLite 原生输入检查确认不支持的内层版本在 Codex prompt 执行或 DSH runner
-加载前拒绝，且不扣额。完整契约/context/DSH/stdio 集合 352 项通过，TypeScript
-检查及聚焦 lint 通过。这只证明上述交互语义，不代表所有必需字段或打包宿主已验收。
-剩余 cache 一致性调查、其他旧 reader 断言、分阶段指令等价和实际 optional/external
-消费者、版本准入及打包宿主连续性仍未完成。缺少显式原生 runtime 的 operation SDK
-检查属于未测，不能算资格。默认 writer 变更尚未交付；PR 因作者实现未完而保持
-Draft，不是仅等待评审。尚无模型或成本收益证据。历史 effect 解码只是临时迁移，
-不得成为第二份永久可执行视图。
-
-### C1 消费链替换与切换单元
-
-切换单元是一个受支持入口**及其下游消费者**，不是一个输出开关。对
-`99921829f2c5` 的源码核对确认以下活跃接缝。这补充前述基线审计；它是迁移设计，
-不表示这些路径已经改变。
-
-| 活跃接缝 | 具体替换与保留的 owner |
-| --- | --- |
-| `quota.py::_emit_quota_result` / `_project_quota_cli_payload` | 在 capture 前组合完整契约，替换 ordinary/envelope 执行格式分支。准入、capability hook、capture IO 与 host poll 回执保留原 owner。诊断 status 视图不是可执行契约。 |
-| `turn.py` 的 `build_fresh_turn_decision_owner().resolve()` 之后 | 携带实际 scheduler execution context 调用同一组合 owner。此入口直接调用 `build_turn_envelope`；仅修改 quota CLI emission 不会迁移 Turn。保留 Turn plan、journal 和回执执行器。 |
-| `heartbeat/task_body.py::render_thin_heartbeat_task_body` | 用统一契约读取指令替换 `captured_envelope` 指令分支，保留精确 selection/reentry transport、通知独立性、必读与原结算身份。保存的 bootstrap 仍在唤醒时解析当前指令。 |
-| `turn_driver/codex_cli.py::_prompt` 与 `host_candidate.py::extract_turn_authority` / `render_prompt` | 在实际 prompt 边界替换格式特定输入。当前普通 Codex 接收 envelope，分阶段 replan 使用提取的 authority，结构化 host 也使用提取的 authority。共享源字节或签名不能证明这些最终输入保留相同义务。保留 provider 结果编码与外层 effect 归属。 |
-| `turn_driver/decision_capture.py` 与 `cli_commands/quota_capture.py` | 复用不可变 capture、校验读取器和 full/delta 交付。首次交付和保存后恢复必须重建同一契约；不能仅因 Turn 身份相同，就把某投影的 continuity baseline 用于另一投影。 |
-| `benchmark/runtime/worker.py`、`benchmark/runtime/sessions.py` 与 `scripts/external_scheduler_worker.py` | 迁移它们实际调用的产品入口。保留评估配置与外层唤醒归属，不新增 benchmark 专用转换，也不把 managed-host 测试算作 attached-host 验收。 |
-
-替换任一接缝前，实现 PR 记录源路径、字段或指令条款、当前 reader、目标 owner、表示、
-恢复与退役条件。字段搬迁须包含引用解析；删除诊断须证明其中不含动作、权限、必读或
-验收义务。未知数据不得静默消失；未知的必需执行语义也不能靠转发 JSON 就变安全，
-相关操作须保持不可用，直到兼容消费者能够理解。不能用子串匹配分类义务。
-
-使用**一次明确的版本迁移**，不在每次唤醒自动协商格式。已迁移 binding 的新准入要求
-组合、交付和消费 reader 兼容。不支持的消费者在 dispatch 前收到可操作的不可用结果，
-不能因此创建第二个活跃 writer。已准入工作继续使用记录的版本和原回执；在这些工作及
-受支持恢复窗口核清前保留历史 decoder。回退同样区分未结工作与新准入。版本迁移不能
-把保存的 prompt、journal 或源 hash 改写成仿佛一直使用新契约。
-
-C1 首个 PR 必须覆盖上述两个生产组合调用点，并交付至少一条从生产端到最终输入的
-完整旅程，同时明确剩余 reader。这个有界切片通过资格，不代表可向未验收 host 开启
-新 writer，也不关闭 C1。最终切换须在全部受支持 reader 验收后删除活跃格式选择。
-临时 decoder 有具名 caller 与退出条件，不是面向用户的兼容视图。
-
-对 normal、selection、replan、wait、recovery 和 capability-off 的每个 fixture，
-在**三个边界**核对独立编写的义务：组合契约、重建交付、最终模型输入及必需材料读取。
-包含旧 action signature 未覆盖的源变化、必需来源缺失、不兼容消费者和结算响应丢失。
-仅重建相等会漏掉 prompt 层丢义务；仅 prompt 完整会漏掉过期权限或重复扣额。
-这些是集成要求，不授权运行模型或启动实验。
-
-1. 盘点实际 producer、reader、writer、已保存 prompt、capture 和外部集成。把每个旧
- 字段与正文义务映射到保留的 owner/字段、权威派生或明确批准的删除。“事实相同”的
- 总括声明不够；保留原失败 fixture。
-2. 通过真实 quota、thin-heartbeat、Turn 入口验收统一契约的单会话执行。每个 binding
- 只切一个 writer；旧 reader 是绑定版本的显式迁移 adapter，列出真实调用方与删除
- 条件，不能成为长期产品视图。
-3. 加入按角色区分的 session、共享生命周期复用及 opt-in 双会话 profile，复用既有
- same-session/native-resume 和 effect recovery 代码。
-4. Benchmark worker 与打包 App heartbeat 采用同一产品 profile。各 host 分别证明
- 观察、停止和恢复；CLI 测试或模型模拟不能证明已安装 App 合格。
-5. 最后一个受支持活跃 reader 迁移后，删除旧 producer、格式选择开关、重复 renderer
- 与双格式测试。只为受支持历史回执 replay 保留版本 decoder。终态验收要求只发出一份
- 契约，不再选择 quota 或 Turn packet 格式。
-
-回退先关闭受影响 profile 的新准入，drain/中断 attempt，核对回执，再在下次准入工作
-恢复先前合格 profile。不能静默替换 native session 或重解释 pending 回执。删除字段/
-decoder 前证明 export、旧版本 readback 与降级行为；满足受支持保留/升级边界前保留旧
-reader。本文不单独授权破坏性迁移。
+完整字段、消费者与验证细节见[契约与上下文迁移附录](controller-executor-unified-contract-v0/contract-and-context.zh-CN.md#c1-wire-布局建议)。
## 9. 验证与验收
@@ -802,80 +773,7 @@ capture 拒绝/恢复及一次结算。本负载来源保真改善，冷态和
### C1 基线边界与复用盘点
-基线是**原路径中调用者实际收到的 quota 交付**，不是内部原始 decision。
-`cli_commands/quota.py` 的原 emitter 先捕获 source；有 capture 时按条件应用
-`replan_cli_view`，再应用 `compact_quota_should_run_cli_payload`，随后原生上下文
-交付还有 full/delta 传输。两组须记录精确版本、host flags、capture 是否可用及 detail
-选项。用更大的内部 source 对比紧凑候选会夸大节省；只用延后读取的首包对比完整候选，
-则会漏算基线的后续成本。
-
-现有路径已包含值得复用的效率行为。C1 应把已合格的语义吸收到共享 TypeScript
-composition/context owner，再退役旧的 caller-specific producer。不能直接套用整个旧
-compactor：精确共享、省略和延后读取的信息与失败后果各不相同。
-
-| 现有信息／变换 | 融合处理与决定性检查 |
-| --- | --- |
-| 已选工作、原始要求、验收、证据、权限及停止条件 | 依赖它们的决策前可用。保留不同 revision 和矛盾证据；lane 标签或 action signature 均不能证明完整性。 |
-| 相同验收副本、嵌套 vision audit、authoring 和可选指导 | 在更小时优先使用契约内一份完整 owner 加精确引用。比较 JSON 类型及每条义务；不同或缺失 owner 时分别保留。不增加补读或决策权。已有 projection 测试只提供特征验证，不代表新消费者已合格。 |
-| 有限 Todo lanes、缩短的建议、省略的边界／历史项 | 视为主动省略，而非无损去重。保留完整性／计数事实和同 capture 恢复；证明被省略项不影响当前决策，或先加载再决策。旧显示上限不能自动变成语义上限。 |
-| 捕获后的 replan review、验收详情和 writeback reader | 区分决策事实与后续 authoring 格式，同时保留原身份和全部必要含义。读取绑定同一 capture；计入每个必需阶段、错误和恢复。引用缺失／过期不能重新 guard 或授权工作。 |
-| Full/delta/resume 交付 | 在 composition 后复用既有 continuity owner。行动前验证精确语义重建与必要材料可用；计入冷回退及丢失基线的恢复。 |
-| Scheduler、准入与结算身份 | Capture 前只有一份权威实例；传输保留真实 host owner、原 Turn 与一次性 effects。重复表示不构成削弱检查的理由。 |
-
-单独后移验收共享不自动构成有价值的前置切片。以主线
-`99cfa3ac559bfa237f04f36fb7e926672fea44b2` 为基线的 source-level 受控替换，
-只把该规则从本地 CLI compactor 移到已有 `reference_context` 调用。同一份含 100 条
-不同要求的合成 fixture 中，序列化投影输入从 102,680 增至 344,010 字节，调用者可见
-输出仍为相同的 102,189 字节。普通路径仍调用一次；全部 detail 开启时由本地共享变为
-一次请求。这些是投影参数测量，不是带协议包装的流量、延迟、模型计费或完整 C1 对照。
-保留此负结果，不能宣称净效率收益。
-
-兼容 owner 也为验收、Vision audit 和 replan authoring 共享复用一份本地 JSON 序列化
-身份。不能用 Python 普通值相等，把不同布尔／数值、整数／浮点表示或带符号零替换成
-另一条观测的别名。完全相同的副本仍共享同一响应内的 owner，包括键顺序不同的情况；
-不同事实保留全文。这修复来源保真，不增加投影 RPC；不代表统一 writer、最终消费者
-或相对原 quota 的成果／完整成本收益已经合格。
-
-先在当前兼容 owner 修复被迁移的验收引用，不引入上述额外传输。已有别名只跟随本次
-投影实际迁移的内联 owner，包括先访问别名、后迁移 owner 的情况。保留完整值、原始
-数值类型、carrier 顺序和现有大小判断；不推断任意引用链，不重写已存 capture。
-完整 C1 composition 应在持有来源的边界吸收该规则，并随调用方退役 Python 兼容
-算法，不能把所有验收副本反复传过另一条 bridge。Writer／consumer 切换和原 quota
-成果／完整成本门继续保持开放。
-
-候选 `895f38fc5` 的固定 source 合成 replan 审计说明了边界的影响。关闭 stride 且不做
-capture 分阶段时，原始 source 为 21,461 个紧凑 UTF-8 JSON 字节，原 quota CLI
-projection 为 20,543，完整候选为 21,738：**相对 CLI 增加 5.82%**，相对原始 source
-则是 1.29%。启用 capture 分阶段后，entry/review/writeback 合计 21,882 字节，候选
-为 21,821。启用 `evidence_conditioned_v1` 时，分阶段合计 28,558，候选为 33,368。
-这里使用既有合成 replan fixture、生产 projection/read 函数与合成 capture 路由；
-不是实际模型轨迹或安装宿主实验。追加的验收／Explore 读取、实际请求包装、缓存行为
-及成果差异均未测。切换 legacy receipt 得到相同数据，不增加独立 workload。这些数字
-不支持净收益结论。
-
-下一实施切片应先在 composition、reader 和 recovery 中验证同契约精确共享，再用上述
-可比负载评估延后详情的取舍。冷启动与分阶段总量分别保留，保留负结果，不能靠删除独有
-指令达到字节目标。
-
-同时报告字段/条款 diff 及其决策后果、实际模型输入、cached/uncached tokens、追加
-读取/往返、重建、延迟、失败/重试、验证与人工介入。首包更小但总补读更多，可能是负向。
-只有必要语义保留且同等验收成果的完整成本降低，或可比预算下验收成果改善，才判正向。
-效果混合则报告取舍；只有传输通过或成果未测时结论仍不确定。按既有测量合同在可比实验
-前确定数值标准，不凭空规定压缩比例。C1 切换须完成这个 quota 基线对照，不能仅凭
-serializer 或字节减少结清。
-
-使用[既有测量模型](long-horizon-harness-benchmark-research-program-v0.md#6-measurement-model)。
-计入两个会话的输入/输出/cached tokens、工具及材料读取、planning/replan/recovery、
-墙钟时间、验证、人工注意力和 provider 成本；未知用量不是零。持久化因果归因，转发
-产物时不重复计算成本。比较可比预算下的已接受成果，不能只看 replan 次数或 executor
-速度。另行授权实验前冻结标准，本文不预设胜出方案。
-
-在后续双会话对照中，除 executor 工作，还要归因 controller 推理及全部交接／材料、
-验证与恢复成本。收支平衡问题是：在保留可比验收成果时，这些**新增完整成本**能否被
-避免的控制／记账、重复执行或人工介入所抵消。即使两会话读同一产物，也按实际重复
-模型消费计量；转发同一用量回执不能把该回执重复计费。报告不同 workload 的取舍和
-账单／缓存覆盖未知。本文不规定通用开销阈值、压缩比例或每条消息 token 上限；此对照
-不替代前置的原 quota 与统一单会话验收。
+完整字段、消费者与验证细节见[契约与上下文迁移附录](controller-executor-unified-contract-v0/contract-and-context.zh-CN.md#c1-基线边界与复用盘点)。
## 10. 运行契约
@@ -895,18 +793,82 @@ backoff 继续归当前 scheduler owner。本文不引入模型空轮询或新
## 11. 规范性交付计划与重构任务
+
+
+### 从现状到可用产品：依赖图与交付切片
+
+```mermaid
+flowchart TB
+ C1[C1/C2：单会话契约与上下文收敛] --> U[C3-C6：一个真实双会话单元]
+ F[已有请求 / 受管操作 / Session owners] --> U
+ U --> I[C6/C8：自主工作循环，同时对话、纠偏、Stop]
+ I --> R[C6/C8：Router 对接两个独立单元]
+ I --> E[C7：单元成果与完整成本对照]
+ R --> E
+ E --> Q[C8/C9：范围化采用与旧路径退役]
+ F -.独立正确性修复与调用方精简可先交付.-> C1
+```
+
+这是实际依赖，不是要求每个 Agent 从第一格开始的固定队列。C1 保持原验收范围；
+其共享 owner 前置、现有请求/恢复修复和删除已被替代代码可独立交付。新 profile 的
+实际切换依赖它消费的统一契约已合格，但不等所有宿主、全部语言迁移或所有 benchmark
+完成。认领依据整体 roadmap、当前用户成果、瓶颈和在途 owner；表中编号不是 PR 数。
+
+| 既有 C 任务下的切片 | 完整可审查交付 / 必须采用的旧 owner | 退出证据与具体精简 |
+| --- | --- | --- |
+| **C1/C2 — 完成现有契约切换** | 沿 #7430 的来源、consumer 与恢复工作收敛，不另写 router packet | 原单会话 quota 对照、字段/条款保真、真实 caller、off 与恢复；逐 caller 删除旧格式 writer，保留具名历史 decoder |
+| **C3/C4 — 一个绑定单元** | 在现有 session/managed-operation owner 中实现同一 Agent 两角色；先资格化一个支持隔离、观察和中断的 Host | 两个真实会话、独立上下文基线；并发/重启不覆盖绑定，旧 generation 不可写；删除被实际替换的单槽位假设，不另建双会话 runtime |
+| **C5/C6.1/C8 — 主循环与执行中交互** | 真实 worker 长操作返回 handle；controller 消费用户与 worker 输入；复用 request revision、queue reservation、Stop 与 readback | 无用户唤醒也能普通结果→评估/反馈→后续执行；原结算与新鲜接续正确；worker 未完成时已有实质答复；纠偏改变后续产物；注意力/安全插队与防饿死场景通过；取消无需等模型；替换该 caller 的整项阻塞等待与重复状态分类，交付同一个 App 旅程 |
+| **C6.2/C8 — Router 接两个单元** | 管家使用既有多接收方、原受众返回与选择绑定；直达 controller 复用同一修订入口 | A 忙时 B 可独立推进；部分拒绝不重跑 A；router 重启后结果回原受众，跨单元权限和预算不扩大；删除重复汇总/路由分支 |
+| **C7/C8 — 比较与小范围采用** | 相同 workload/Host 下比较原单会话、统一单会话、双会话；额外单列多单元协调组 | 同预算成果与完整成本、响应/纠偏/停止时延、人工介入；小任务负例与模型/Host 边界公开。打包 App/CLI 与受支持 Lark 失败恢复分别验证 |
+| **C9 — 点名退役与默认决策** | 每条替换随 caller、历史读取窗口和回退证据删旧代码，采用决定按合格 workload/profile 范围作出 | 无第二套决策/任务/预算账本；新准入关闭后原 attempt 可对账；保留合格单会话，不以少代码或多会话数量证明收益 |
+
+建议最近的实施决策是：先对齐 C1 在途交付与当前 session owner，选择一个真正支持
+worker 非阻塞观察、工具隔离和 Stop 的 Host，形成“一个自主单元循环 + 执行中交互”的可审查
+切片；管家已有多接收方链在其后采用。相关绑定/恢复精简若能直接改善现有 caller，可
+先合入，不要求等 C1 整体完成。无需先做全局 scheduler、通用消息中间件、无限层级 Agent
+或第三套状态存储。尚未完成的双向 Host 能力应补在实际 adapter，不把接口统一当作完成。
+
+
+
+### 何时可以称为 Superagent 的实践
+
+“Superagent”在这里是产品假设：**可长期托付、执行时仍可沟通、能恢复并交付有据可查
+成果的 Agent 单元**，不是模型等级或已证明的最佳实践。以下用例一起限定宣称范围：
+
+| 用例 | 独立 oracle / 比较 |
+| --- | --- |
+| 初始授权后不再发用户/router 消息 | 普通 worker 发现触发 controller 评估、有效反馈与后续已准入工作段，无需求助或人工唤醒。核验实际产物变化与独立验收，不以消息数代替；有必要时负面证据改变下一决策。原工作仅结算一次，新准入后继续；有依据的等待/停止仍有效 |
+| 用户提问插入评估或下一次派工 | 答复后按当前事实选择仍有效的主循环待办；不丢结果、不停滞接续、不自动回汇报，也不为答复另启替代 worker；新准入工作段保留自己的身份 |
+| 忙碌 worker + 用户问题 + router 新输入 | 在 worker 完成前有实质回复，两个控制输入均有记录；原 worker attempt 数量不变。测到达→处理→回复分段时延，不只测入队 ACK |
+| 用户直达与 router 转发同一修订，随后互相冲突的独立修订 | 相同身份不重复应用，不同来源保留版本及处理理由；实际后继产物遵守有效要求 |
+| 两单元独立执行 + 一个拒绝/失联 | 未受影响单元继续；拒绝/未知可见，重试不复写已成功效果，资源不被逐单元放大 |
+| Controller/Router 重启、乱序/重复结果、结算回复丢失 | 恢复原 attempt、输入和回执；不重复执行/扣额；旧 generation 和迟到结果不能接管新工作 |
+| 满队列或模型不可用时 Stop/撤权 | 已有 Host/Core 停止路径仍可达，确认与真实停止分开；未知外部效果仍待对账 |
+| 主动汇报中 worker 阻塞，随后用户纠偏 | 先让出后台汇报并解阻；用户纠偏先于依赖它的新 effect；不因插队重启原 worker；重新选择主循环工作，仅在适合时更新报告；已发送/不确定投递不重复发送 |
+| 进度刷屏、router 转达用户请求、同级与乱序输入 | 用户来源与必要依赖不被传输路径降级；普通进度/自称紧急不插队；同级 FIFO、revision 因果保留；跨重启选择不丢原输入 |
+| 不可取消操作 / 旧模型迟到输出与用户输入竞态 | 原 effect 可完成/对账，旧 invocation 的新工具提案不执行；无重复效果，真实等待与无法抢占可读，controller 不中途另开并发写入方 |
+| 持续前台输入与重复打断 | 在声明容量下，前台可响应且仍有效的主循环工作/应返回结果不被无限延后；统计服务时延、worker 等待、最长延后、取消/重做 token；过载显式背压，Stop 不排队 |
+| 同等验收下的简单任务与长程任务 | 比较完整模型/工具/恢复/汇报成本、约束遗漏、验证成果、纠偏返工和人工注意力。短任务允许单会话胜出；异步响应快不等于总完成更快 |
+
+复用已有语义 oracle，在真实隔离 File/SQLite 和所选原生 Host 上跑完整链，再资格化
+打包前端；改变 PostgreSQL authority 语义时追加其真实隔离验证。不将每个状态排列
+复制成一套巨大端到端 fixture：共享不变量测试加薄 adapter 与少量代表性全链路案例。
+阈值在实验前随 workload 与现有测量合同冻结，未测/未知不记为通过。本文不启动付费
+实验、不变更默认 profile，也不以实现这套拓扑作为所有任务的通用前提。
+
这些任务扩展整体路线图 S2/S4/S6/S7/S11 和 effect interpreter 既有融合工作，不另立
路线图。认领前对齐相关活跃任务/PR，复用已合格修复，不重复实现。下列 task ID 是稳定
设计引用，不代表 canonical Todo 已完成。
| 任务 / 依赖 | Owner 与实际替换内容 | 决定性退出 / 回退 |
| --- | --- | --- |
-| **C1 — 统一契约；首先** | Interaction/work-context + quota/Turn owner：盘点字段/指令、capture/视图/读取证据映射及分版本双层配置；捕获同一 schema，迁移普通 quota/Turn producer 与 thin renderer | 单会话真实入口保留必要信息、动作绑定和一次结算，并完成第 9 节 quota 基线效果/完整成本对照；保留显式 off，cutover 合格前保留绑定版本的 reader |
+| **C1 — 统一契约；新 profile 切换依赖** | Interaction/work-context + quota/Turn owner：盘点字段/指令、capture/视图/读取证据映射及分版本双层配置；捕获同一 schema，迁移普通 quota/Turn producer 与 thin renderer | 单会话真实入口保留必要信息、动作绑定和一次结算，并完成第 9 节 quota 基线效果/完整成本对照；保留显式 off，cutover 合格前保留绑定版本的 reader |
| **C2 — 一个上下文交付管线；C1** | Context owner + host observer：组合跨 Host Progressive、独立资格化 Delta、同 capture 详情/恢复和保守未读发现，替换分阶段候选交付及重复 packet 分支 | 未变未读约束抵达下一 Turn 实际工作；按完整成本验收无 Hook reader、精确证据/连续性和四种分层组合；full 回退不重新准入；经既有 owner 回退编码/配置 |
| **C3 — 会话绑定与原生生命周期；C1** | Session/runtime owner：扩展 role/generation，复用 native create/resume/observe/interrupt 和有序队列 | 两角色不覆盖 Agent native ID、不借用基线、不竞态执行；重试前观察既有 attempt；关闭新角色准入即可开始回退 |
| **C4 — 共享受治理生命周期；C1** | Effect/Turn owner + 外层 worker adapter：围绕既有 typed 操作与回执合并重复 prepare/dispatch/observe/validate/writeback/settle 编排 | App/Turn/external worker 在部分失败下对准入、原结果与一次扣额一致；scheduler effect 保留真实 host owner；核对回执后才切回旧调用方 |
| **C5 — Replan 与结果编写边界；C1** | Goal/Vision 与 interaction owner：提供当前事实和 typed controller 操作，移除双会话 profile 中普通 executor 编造 Core 写回字段的义务 | 先看事实保留 default/stride policy 区别、全部证据与必要验证；非法写回拒绝；rollout 期间单会话编写仍合格 |
-| **C6 — Controller/executor 交流；C2–C5** | Manager/request + host owner：复用版本化语义请求与结果返回，用自然语言工作/材料交流替换 executor 的 schema 约束任务；执行时用户仍可交互 | 完整来源、局部自主、Core 隔离、纠偏往返、有序 revision 下的反馈实际采用及独立验收结果；第 9 节忙碌、冲突、Stop 和迟到结果场景；回退后新工作使用合格单会话 profile |
+| **C6 — Controller/executor 交流；C2–C5** | Manager/request + host owner：复用版本化语义请求与结果返回，用自然语言工作/材料交流替换 executor 的 schema 约束任务；执行时用户仍可交互 | 完整来源、局部自主、Core 隔离、无需人工催促的普通结果→评估→反馈→后续执行、有序 revision 下的反馈实际采用、原结算/新鲜接续与独立验收结果；第 9 节忙碌、冲突、Stop 和迟到结果场景；回退后新工作使用合格单会话 profile |
| **C7 — Benchmark 复用与完整成本归因；C4/C6** | Benchmark toolkit/execution owner：薄 adapter 选择相同产品 profile；合并重复 launch/session 配置，跟踪两个会话，不改冻结 trial | Native/plain 对照不变，可比组配置/replay 与完整成本覆盖；合并 helper 不启动 job |
| **C8 — 产品配置与运行 readback；C3/C6** | 既有 App/settings/Chat 投影：同一 effective configuration owner，按角色展示 activity、失败/恢复、主动循证汇报、适合任务的丰富展现、反馈/readback、Stop 和产物返回 | 第 9 节打包 managed 及受支持 attached heartbeat 旅程，包括 host 不可用、迟到结果、安静/去重汇报、可访问降级、受众拒绝和恢复；安装资格另验；不新增 packet 格式开关 |
| **C9 — 旧路径退役与采用资格；C1–C8** | Contract/runtime 维护者：删除被替代 producer、格式开关、重复提示/测试，更新 protocol、guide 和 RFC 交付事实 | 调用方/字段/decoder 退役清单、历史 replay 与回退证据；App + benchmark 验收及可比收益成立后再决定默认提升 |
@@ -1005,7 +967,7 @@ C1/C2 组合/capture/最终输入工作与这些精简同属一个候选前沿
| 既有任务 / 工作包 | 精简结果 | 启动条件 |
| --- | --- | --- |
-| **C3.1 受管操作协议** | Codex、DSH 采用同一操作会话流程；删除重复 binding/profile 校验、handoff/start 编排，以及 DSH 对 Codex 模块内通用 handler 的依赖 | 此重复被选为当前瓶颈时：现有单会话行为、两个真实调用方，保留原生差异 |
+| **C3.1 受管操作协议** | 通用 handler 与 session 选择已共享；新角色沿该边界扩展，核对后才删除剩余重复调用方 | 复用 `managed_operation_host.py`；不能再次把已完成抽取列为待办，保留两个真实 Host 的原生差异 |
| **C3.2 会话绑定调用方** | 复用共享持久化；以既有完整操作替换调用方重建 binding 和跨 Host 私有导入 | 若独立拆开只剩改名/facade，则与 C3.1 一起交付；role/generation 扩展等待 C1 稳定 |
| **C4.1 回执到继续决策** | 采用已合格 typed Turn 观察/继续边界；退役被替代的 Python 回执重建与决策 | 保留 journal 恢复与下一工作决策的区别；整合 C1 及已有恢复修复 |
| **C4.2 外层 worker 采用** | 消费已合格语义结果，移除自行重建的公共重试/继续策略 | C4.1；保留唤醒归属、原回执和不透明命令的不确定性 |
@@ -1050,6 +1012,13 @@ C1/C2 组合/capture/最终输入工作与这些精简同属一个候选前沿
controller/executor 隔离架构影响；更便宜的 controller 模型与不同预算另行实验。
完整成果/成本证据支持决定前，profile 保持 opt-in。
+4. **异步宿主与队列能力映射——C3/C6 owner，在首个单元上线前。** 点名返回 handle、
+ 事件恢复、role fence、live steer/下一边界、Stop 和工具隔离的实际支持范围；容量、
+ 注意力选择、后台生成让出与响应目标由该 workload 资格确定，不推测所有 Host 等价。
+5. **跨单元预算与原受众汇总——既有 request/quota/product owner，在 C6.2 前。**
+ 映射已有资源限制和返回身份，明确部分失败、用户直达与 router 转发的去重；缺少的
+ typed 事实在原 owner 增补，不为 router 建第二台账。
+
## Appendix A: Execution ledger / 执行记录
源码核对及后续交付证据位于
diff --git a/docs/architecture/rfcs/controller-executor-unified-contract-v0/contract-and-context.md b/docs/architecture/rfcs/controller-executor-unified-contract-v0/contract-and-context.md
new file mode 100644
index 0000000000..661db8882c
--- /dev/null
+++ b/docs/architecture/rfcs/controller-executor-unified-contract-v0/contract-and-context.md
@@ -0,0 +1,697 @@
+# Contract and context migration: Controller RFC technical annex
+
+This annex belongs to the [main RFC](../controller-executor-unified-contract-v0.md). It retains field, read,
+historical-evidence and cutover requirements; it is not another RFC, task queue or
+architecture. Start with the main system diagrams and current delivery path.
+Historical experiments retain their revisions; their descriptions of “current”
+behavior do not supersede the latest audit in the main document.
+
+### C1 source audit: shared owners and the remaining split
+
+Bound native execution preparation retains the ordinary managed claim reference
+and captures its same-Turn ready decision before CLI compaction. The Host hands
+that source to the existing saved-capture presentation/reader owner, rather than
+discarding it and making the model evaluate another guard to obtain its current
+contract. Goal, Agent, Todo and Turn must match before publication. Required
+material reads, including an explicit complete Goal read, remain required; a
+ready receipt or saved file does not fulfill them. Optional presentation failure
+retains the original digest-bound recovery. Explicit off is inert, and an
+unbound request keeps its original readiness route without inventing a Turn.
+This is a bounded Host handoff repair, not C1 cutover, installed adoption or
+qualification of model cost and long-horizon benefit.
+
+The source already shares more than the output names suggest. `_emit_quota_result`
+captures the complete decision **before** `_project_quota_cli_payload` chooses
+ordinary CLI compaction or `buildTurnEnvelope`. The latter delegates to the
+TypeScript owner; its Python module is a transport adapter. Both quota capture
+and Turn journal capture call `write_decision_capture` in
+[`decision_capture.py`](../../../../loopx/control_plane/turn_driver/decision_capture.py).
+Native context delivery and explicit host handoff also reuse that module and
+the existing context-delivery owner. C1 must converge the remaining composition
+and consumer assumptions, rather than introduce another capture service or
+rewrite already shared delta/native-resume logic.
+
+Optional host polling is part of that original observation. The source-fidelity
+slice records `--record-host-poll` once before capture and reuses its receipt in
+ordinary CLI, envelope and native-context delivery. Recovery reads do not poll
+again. A later capture/handoff failure retains the already-recorded observation
+in its error response; it does not imply missing admission or authorize replay.
+Default-off behavior and unreadable receipt diagnostics remain unchanged. This
+repairs capture completeness, not the unified writer/consumer cutover or a
+long-horizon cost-benefit result.
+
+A separate native-presentation slice reuses the committed full recovery as its
+reader target, avoiding an unused second wire publication. Delta and unwrapped
+inputs retain their own immutable files and the same reader/lifecycle owners.
+On a matched 107,289-byte synthetic source, capture writes fall from 216,754 to
+107,289 bytes; full reader bytes and the 3,937-byte warm delta are unchanged.
+This qualifies only duplicate capture IO removal, not model-input reduction,
+complete cost, accepted outcomes or C1 writer/consumer cutover.
+For a small explicit output ceiling, native presentation can also omit repeated
+directory/selection commands while retaining the complete recovery command:
+append `--list` or `--select` to discover/read current facts without a baseline.
+The original 4,000-byte cold/warm/compaction cases retain their requirements,
+Stop, original identity and full recovery; this is transport qualification.
+
+Journal persistence is an independent source-fidelity prerequisite. The proposed
+Python adapter reuses context delivery's sparse number-token collector; both
+TypeScript consumers reuse one source-number validator. Journals remain JSON
+objects, with metadata only for integral floats, signed zero and unsafe integers.
+The journal owner restores these numbers before atomic publication and retains
+their distinctions in replay and immutable-plan comparisons. Ordinary native
+objects retain their encoding; historical receipts are not rewritten.
+
+The interim whole-JSON-string carrier failed the existing 2 MiB request boundary
+for a synthetic 1.55-million-character quoted body accepted by the object path.
+Keep that negative result: qualify the sparse replacement against the same
+workload and limit, including number-dense overhead. Neither this prerequisite
+nor a component byte saving qualifies the unified writer/consumer cutover or
+long-horizon net benefit.
+
+The proposed Turn selection-reader slice removes the Python adaptive-selection
+decision from the driver. Its existing plan, Host, Session, completion and
+settlement callers use the interaction owner's `selectedWorkTodo` rule through
+the existing source-edit transport. The selection adapter retains Python's historical
+scalar/whitespace decoding; original records and numeric values stay intact.
+This retires one duplicate rule, not the historical envelope format. Complete
+writer/consumer cutover and original-quota outcome/full-cost qualification remain
+open. The added bridge calls must be counted; code convergence alone is no
+evidence of lower cost.
+
+| Current source / obligation | Present envelope treatment | Required C1 disposition |
+| --- | --- | --- |
+| `interaction_contract.agent_channel.work_context` and pending required reads | `work_context` plus `required_reads`; identical inline material can be referenced | One complete requirement/evidence source with resolvable references; preserve pending reads and their completion conditions |
+| Selected Todo, recommended action, action portfolio and planning horizon | `action`; reference relocation and text compaction occur in `turnActionProjection` | One selected work/action identity; preserve complete actionable clauses and distinguish summaries from executable instructions |
+| `interaction_contract.cli_channel.settlement_plan` | Copied into `writeback.settlement_plan`, including original effect identity and conditional steps | Reuse the settlement owner unchanged; neither controller dialogue nor a new capture creates another debit identity |
+| User/agent interaction channels, execution policy and task orchestration | Separate `user`, `execution_policy`, `boundary` and orchestration sections | Preserve notification versus execution obligations, authority and stop gates; do not derive them from prose |
+| Replan packet, required reads and staged writeback | Dedicated replan projection and deferred writeback | Preserve fact/source access, policy-specific triggers and ordered mutations; no blanket activation of stride behavior |
+| Scheduler context and execution ownership | Scheduler projection with caller execution context | Carry the actual host owner and ACK obligations; a common schema does not transfer scheduler authority |
+| Complete saved decision, action signature and journal binding | Source hash, projected action hash and captured-decision reference are distinct | Preserve the distinction between semantic integrity, exact transport bytes and receipt identity; no hash substitution |
+
+This is an owner-and-obligation map, **not an exhaustive field inventory or a
+parity result**. Current projections have bounded text, allowlists and relocated
+references. Matching their action signatures alone cannot prove preservation of
+all source clauses or unknown fields. C1 implementation must enumerate those
+fields and callers against its exact base/head; anything unclassified holds
+cutover, rather than disappearing into an assumed compatibility view.
+
+A synthetic probe of the named baseline demonstrates the limit: two long
+`recommended_action` strings with identical prefixes but different tails produce
+the same action-signature document and both report `matches=true`, while their
+`source_decision_hash` values differ. An unregistered top-level source field has
+the same distinction. Conversely, a complete registered settlement plan survives
+projection, and changing its Turn identity changes the action signature. These
+observations reject promoting the existing bounded envelope unchanged into the
+complete contract. They do **not** establish a current authority-loss bug: the
+recommendation is diagnostic, the unknown field is synthetic, and the complete
+source commitment still distinguishes both inputs. No model benefit is measured.
+
+### Differential context
+
+Reuse the existing context-delivery owner and immutable capture mechanism.
+The target has two orthogonal layers; neither creates another semantic producer:
+
+- **Layer 1 — Progressive:** default model-facing delivery across LoopX hosts,
+ including ordinary CLI, MCP/HTTP and external workers without Session Hooks.
+ Keep the current Goal, applicable cumulative acceptance, failures/unknowns,
+ authority, stop conditions and outstanding read/settlement obligations inline.
+ Fold heavy history, source bodies and review evidence only through the existing
+ typed composition owner, with exact current-capture read routes and explicit
+ before-dependent-work obligations. Unknown relevance/schema keeps the complete
+ necessary material. This is a delivery default, not permission to collect or
+ persist additional data. A caller without an authorized, usable reader receives
+ complete inline context; a local file path is not a working remote read route.
+ If hard Host limits prevent both routes, expose unavailable context and hold
+ dependent work.
+- **Layer 2 — Delta:** an exact encoding of the composed instance, automatically
+ selected only with qualified consumer/session, role, epoch, schema and source
+ binding. Progressive can use full encoding; a complete inline instance can use
+ Delta. Qualify both combinations as well as Progressive plus Delta and neither.
+ A host without qualified continuity uses current full encoding of Layer 1,
+ without losing Progressive or requiring a native session to be invented.
+
+Distinguish two existing reuse claims. **`captured_file`** compares verified,
+compatible immutable saved artifacts; exact reconstruction does not require the
+model to have read the old file, reached EOF or retained its contents. **Retained
+model-input reuse** may omit previously delivered text only with trusted complete
+delivery and retention evidence for that exact consumer binding. A saved file,
+tool-output receipt or model self-acknowledgement cannot establish that evidence.
+Session Hooks observe their supported boundary; they grant no new authority.
+Preserve deletion, array order, null, empty values, original numeric values and
+complete strings. Unknown fields stay complete until reuse semantics are
+registered. Publish the current complete recovery source before an optional view
+or delta, verify reconstruction, and choose full when Delta plus its metadata is
+not smaller. Layer 1 likewise compares its final serialized UTF-8 view, read
+guidance and index with the same capture's complete alternative; use the smaller
+valid delivery, never trim mandatory meaning to meet a size budget.
+
+Current authority, admission, cancellation, unresolved-read, settlement and
+scheduler facts stay fresh and inline even if unchanged. A warm transport never
+relaxes the underlying instructions. Missing/out-of-order deltas, corrupt or
+unknown baselines select current full encoding/recovery. Truncated or missing
+reads recover the necessary range from the same capture. Compaction invalidates
+retention for the next work Turn's new baseline epoch; it neither invalidates the
+existing Turn nor forces an old-packet prefetch or immediate full reread. Preserve
+the original admission, recovery reference and once-only settlement/debit.
+Execution still checks current source validity and authority; recovering an old
+capture cannot revive cancelled work. The executor's task conversation consumes
+semantic material separately, not a relabeled controller Core-packet delta.
+
+#### Unread material across Turns
+
+Current immutable captures already support exact selected reads. The missing
+design is explicit discovery of unread material across deliveries, not a second
+reader or a requirement to consume an entire baseline. Extend the existing
+context/readback owner and native `session.json` projection; use its equivalent
+consumer binding on other hosts. Distinguish publication, model-visible delivery
+coverage, retention and semantic adoption/accepted outcomes.
+
+`confirmed_read_sections` is a proposed coverage projection;
+`consumed_pointers`, if retained as a name, must derive from that same owner,
+not become a second ledger or imply comprehension. Bind evidence to the exact
+source/capture digest, revision, consumer/session role, epoch, schema and selected
+pointer/range. Confirm coverage only from trusted Host observation of the actual
+model-visible result. Calling `--select`, file existence, reader EOF, a successful
+tool log or a self-ACK alone is insufficient. Partial/truncated/missing output
+stays unconfirmed; selecting a parent/index cannot confirm hidden descendants.
+Without such an observer, coverage is unknown and discovery stays conservative.
+This coverage never becomes a new full-read gate for `captured_file` Delta.
+
+Every warm delivery carries an **`unread_context_index`** (proposed name) for
+eligible non-inline material whose current content is unconfirmed or changed,
+including unchanged text omitted by Delta. Include exact current pointers,
+source revisions/digests and required-read status, rather than inferred relevance
+from a summary. A confirmed range applies only to its observed version; changed
+content, reordered arrays or ambiguous mappings require current rebinding and
+conservative discovery. Confirmed delivery never proves retained input or adoption.
+
+Each item resolves independently through existing `quota context-read --select`
+against the **current complete immutable `projection.json`**, with its exact
+capture SHA, without the previous packet, baseline file, model memory or patch
+chain. A derived `required-context.json` or wire view retains the existing owner's
+explicit mapping to the canonical source; roots and digests are not interchangeable.
+Historical exact-version lookup remains a separate, version-pinned artifact/read
+contract, not an invented path alias or a reason to silently use stale facts.
+If still-required earlier material is absent from the new projection, its owner
+must carry it forward or expose its current authorized source/read obligation.
+Legitimate expiry, revocation or removal must remain explicit, with unavailable
+required material holding dependent work; never silently mark it read or retain
+forbidden raw data. External materials keep their own source-consumption contract.
+
+#### Configuration and migration
+
+The following is proposed behavior, not a change to today's Codex-scoped
+`context_delivery` on/off interface. Evolve the existing typed configuration owner
+to express the two layer decisions; C1 maps exact names and versions before
+implementation. Do not add a parallel settings store or packet-format toggle.
+
+| Configuration / caller | Migration and effective behavior |
+| --- | --- |
+| No saved preference, model-facing caller | Target Layer 1 default applies after that caller's reader/fallback and cost qualification; Layer 2 is auto only for a qualified continuity host, otherwise full encoding. Today's ordinary CLI/other-host full behavior remains until that rollout qualifies. |
+| Explicit invocation/environment off | Preserve current precedence and full/raw delivery for that invocation, with no optional codec/coverage-ledger dependency; do not rewrite the saved preference. |
+| Existing persisted off | Preserve the complete off path and its original read/recovery obligations; never convert it to Progressive or Delta through an absent-preference migration. |
+| Existing on, supported host | Preserve the qualified native file/recovery semantics while mapping to Layer 1 plus qualified Layer 2 auto; no full-model-read prerequisite is introduced. |
+| Existing explicit on, unsupported host | Preserve the current validation error during compatibility. A versioned caller rollout may expose supported Layer 1 after qualification; do not silently reinterpret an unsupported request. |
+| New independently configured layers | Honor each layer independently, including Progressive off with qualified Delta auto. Explicit Delta off preserves Progressive; unsupported auto falls back to current full encoding. |
+| Internal raw machine consumers | Preserve their explicit `--context-delivery off` contracts; do not replace machine JSON with a model-facing file reference or mutate preferences. |
+
+Freeze recorded versions, experimental configurations and historical receipts.
+Qualify default expansion as a behavior change on real callers, including explicit
+off isolation and failure/recovery; a merged design alone changes no defaults.
+
+#### Delivery acceptance
+
+Reuse C1/C2's real-entry and §9 comparisons, including these decisive cases:
+
+| Case | Required observation |
+| --- | --- |
+| Ordinary no-hook CLI and supported MCP/HTTP/worker routes | Layer 1 works through the actual authorized reader or complete inline fallback; no dangling local-only references or invented native epoch. |
+| Unchanged unread tail becomes decisive next Turn | Warm Delta may omit its bytes, but the current index exposes its full source and actual subsequent selection/work obeys the recovered constraint. Index visibility alone is not success. |
+| Changed/unread bodies, reordered arrays, unknown fields or scope | Rebind to the current source; preserve applicable cross-Agent obligations and unknown-scope complete fallback. |
+| Partial pages, lost/truncated tool output, EOF without a Host witness | Do not confirm unseen bytes or hidden descendants; recover missing ranges, conservatively index unknown coverage, and keep file Delta usable. |
+| Compaction, role/session/schema/epoch change | Invalidate incompatible retention/reuse; recover current facts without replaying the original admission, effects or debit, and without old-packet prefetch. |
+| Revoked source, missing reader or legitimately removed material | Respect the current permission/source owner; expose the loss and hold dependent work or use authorized complete fallback, without stale-data disclosure. |
+| Full is cheaper; off and legacy configuration | Choose valid full delivery, preserve explicit off and frozen versions, and observe both source identity and raw machine-consumer parity. |
+
+The primary stored-body reduction is **`1 - V/F`**: `F` is the complete capture's
+actual UTF-8 file bytes and `V` the selected view body file's actual bytes from
+that same capture; saved bytes are `F - V`. Bind both artifacts and their digests,
+and report wire/index overhead separately rather than changing that denominator.
+The delivery size guards above still include their actual presentation overhead.
+A net-benefit claim also counts all later reads/recovery, host/controller/executor calls and latency,
+actual tokenizer/cached/output usage, human attention and accepted outcomes.
+Preserve unfavorable cases and frozen budgets. A smaller packet alone proves
+neither lower token cost nor better outcomes; §9's original quota single-session
+comparison stays primary, and two-session costs remain a separate comparison.
+
+### Candidate context by decision stage
+
+Preserve complete candidate context in the canonical capture; deliver it according
+to the decision the consumer must make through the same C1/C2 owners. This is a
+proposed replacement contract, not permission to skip existing required reads.
+The current capability gate assigns selection to the Agent. A `selected_todo`
+projection or list order alone does not prove that comparison is finished. Keep
+the complete-context repair in [#7557](https://github.com/loopx-project/loopx/pull/7557)
+until consumers and recovery obligations are replaced together.
+
+| Decision stage | Required input before the dependent decision |
+| --- | --- |
+| Select or reconsider work | Complete discoverable candidate index: identity/revision, original objective, declared Goal contribution, priority, eligibility, ownership, dependencies/blockers, current evidence/uncertainty and exact captured detail reference. Missing facts remain unknown. Read full detail for compared alternatives; if the index cannot establish whether an alternative matters, expand it before choosing. Do not silently keep only a top-K set. |
+| Continue admitted work | Full selected task, original and cumulative requirements, applicable global/shared constraints, dependencies, contrary evidence, current authority and stops. A registered continuation contract may defer independent alternatives while exposing new/changed eligibility and evidence that can require reconsideration. An Agent still instructed to select over all runnable candidates remains in the selection stage. |
+| Replan or accept the Goal | Expand all affected work and acceptance, including cross-Agent dependencies and contradictory evidence. Unknown scope expands to the complete captured basis. Ownership and earlier local completion do not prove irrelevance. |
+
+These are consumer obligations, not three packet schemas or new scheduler modes.
+The typed owner determines which reads can be deferred under an explicit contract;
+the Agent/controller makes the semantic choice. Author-provided purpose or risk
+summaries help discovery but cannot prove omitted prose irrelevant. Do not infer
+relevance from keywords, claim labels or a model-authored score. Without sufficient
+typed facts, comparison can still require all bodies: cold selection has no
+promised compression ratio. Default expansion of the current Agent's outcomes is
+useful for ordinary work, with other outcomes discoverable; shared requirements,
+dependencies, conflicting evidence and unknown relationships override that default.
+Outcome scope and candidate selection remain distinct owners.
+
+Extend the existing immutable reader to batch selected details from the **same
+capture**, retaining each requested item's revision, lineage, integrity, coverage
+and cursor. Distinct revisions of one Todo stay distinct. Missing, truncated,
+unsupported or changed detail holds dependent work and uses that capture's full
+recovery; a fresh guard is not a detail reader. One read can deliver several bodies;
+verified bodies need not be repeated within a supported retained session. Reading
+an index never acknowledges hidden bodies. Retained-model reuse covers only text
+actually delivered and retained for that consumer; saved-file Delta has its
+separate artifact proof above. Newly required detail must supply its text even
+if the machine already holds it. Context loss recovers the required model
+artifact, widening to the full source when its scope is unknown. Historical captures
+keep their original obligations. Read receipts prove coverage, not comprehension,
+retention, fresh authority or acceptance.
+
+The single-session Agent consumes this same pipeline. In the controller/executor
+profile, the controller compares alternatives and absorbs Core bookkeeping;
+the executor receives the complete selected work and authorized materials through
+the existing host channel. It does not become a Core client or receive every
+alternative to compensate for an incomplete brief. Reuse capability eligibility,
+work-context/read fulfillment, capture/detail and delta owners; add no parallel
+candidate store, Python relevance policy or per-item approval round trip.
+
+Qualify against original quota single-session delivery and the corrected complete
+context on matched inputs. Include a decisive constraint at the end of an initially
+unexpanded candidate, a useful alternative beyond any display limit, changed peer
+evidence, a now-runnable blocker, identical titles with different requirements,
+missing metadata, context loss and failed batch reads. Actual choice and subsequent
+verified work must honor the constraint; reconstructable JSON or an unchanged
+selected ID is insufficient. Count initial input, all detail reads, paging, retries,
+recovery, both sessions' calls, latency and human intervention through accepted
+outcomes. Keep small-task and cold-selection counterexamples where staging costs
+more. Report bytes separately from tokens measured with the actual model tokenizer.
+
+Delivery stays within C1/C2: qualify the shared same-capture reader and required-read
+recovery through an actual caller; replace that caller's stage-specific delivery
+and obligations together; then qualify retained delta and matched outcomes/full
+cost. Reuse [#7560](https://github.com/loopx-project/loopx/pull/7560)'s outcome-scope
+work without treating outcome relations as candidate-selection proof. Diagnostic
+counter folding in [#7587](https://github.com/loopx-project/loopx/pull/7587) is a
+separate compatible slice, not this replacement. Each slice can have its own PR
+and rollback; no generic retrieval framework or two-session rollout is required.
+
+The native quota caller now implements a bounded acceptance-material slice:
+known cumulative objectives, complete requirement descriptions and current review
+states remain in its required view; source history and review notes/evidence are
+addressable in the original immutable capture. Its read obligation, full/delta
+baseline and recovery move together. Selected detail reads never fulfill hidden
+required content or establish a full baseline. Unknown semantics and signed
+envelopes remain whole; the disabled path is unchanged. The original capture's
+values survive the typed path plan without a JavaScript numeric round trip.
+If the required view plus its detail index is not smaller in serialized UTF-8
+bytes, retain full delivery and its original obligations. Default detail examples
+select source, note or evidence fields rather than replaying the whole outcome.
+
+Native exec and code-mode fixtures also qualify two compactions within one work
+Turn: a sufficient working brief continues with the original work/settlement
+identity without replaying its packet or re-entering admission. The baseline is
+still invalidated; unfinished initial reads and missing necessary facts require
+same-capture recovery, while a new work Turn obtains its fresh guard. This is
+native protocol qualification with deterministic inference, not evidence of
+model compliance or live outcome/cost benefit. C1/C2 remains incomplete:
+candidate, preference and Explore staging, signed-envelope migration and matched
+accepted outcomes with complete costs still need their own qualification.
+
+### C1 wire-layout recommendation
+
+The target combines quota packet's decision-necessary information with
+TurnEnvelope's efficiency and replaces both. “Complete” means complete necessary
+semantics, not every duplicated diagnostic in today's packet permanently inline.
+The lossless root-preserving candidate below is an intermediate migration oracle:
+it exposes omissions and reference breakage while consumers move. Renaming that
+candidate or forwarding all old fields does not satisfy the final design.
+
+Inventory each field and instruction clause with its owning rule and consumer.
+Keep current task, original requirements and revisions, relevant evidence,
+authority, required reads, execution/stop conditions and original settlement
+obligations available before their dependent decision. Reuse typed ownership to
+remove proven duplicate representations and unrelated diagnostic noise. Stable
+material can be referenced or differentially delivered only with verified
+retention or a resolvable, integrity-bound source and explicit read ordering;
+missing context must recover before dependent work. A reference alone does not
+prove that the model received its constraints. Unknown fields cannot be silently
+classified as optional or dropped by a prose heuristic.
+
+Within one canonical contract, absorb the useful envelope properties: clear
+execution identity and action organization, a single machine-owned binding,
+less duplicate instruction text, bounded delivery and reliable detail/recovery.
+Full/delta/detail are encodings of that instance, not permanent competing semantic
+views. Preserve raw source evidence in its existing owner without emitting a
+second executable packet. The final wire layout may change where its mapped
+references, consumers and measured benefit justify it; root preservation is not
+an immutable product constraint.
+
+| Source or concern | Candidate mapping and qualification |
+| --- | --- |
+| Current decision fields during migration | Preserve path/value in the lossless oracle; enumerate all modes and classify necessary semantics, proven duplication and diagnostic-only material before the final mapping. Do not infer optionality from one observed packet. |
+| Work context, required reads and settlement | Keep their existing `interaction_contract` paths and owners. Existing root-relative references retain their meaning; any intentional relocation requires explicit reference and reader migration. Never rewrite prose or command strings by pattern. |
+| Host-operation binding | Compose from the actual caller execution context. Validate consistency with source authority; reject conflicting bindings rather than choosing whichever representation is convenient. |
+| Content and transport integrity | Commit the entire semantic instance independently of the former compact action digest. Preserve exact capture-byte verification and original settlement identity as separate checks; changing a transport encoding does not create a new effect. |
+| Complete capture and Progressive view | Keep canonical `projection.json` distinct from its derived `required-context.json`/wire view; inventory exact root, revision, digest and pointer mappings. Save complete recovery before presentation; reference only through an authorized usable reader. |
+| Saved-file reuse, delivery coverage and retention | Inventory each existing typed owner and its evidence boundary separately. Proposed `confirmed_read_sections`/derived `consumed_pointers` describe observed coverage only; neither is artifact-reconstruction proof, comprehension or a full-read gate for file Delta. |
+| Unread discovery | Map the proposed `unread_context_index` to current complete-capture pointers, revisions and source/read obligations, including unchanged unconfirmed material. Rebind changed/unknown mappings; retain explicit unavailable states and permission checks. |
+| Historical receipts and readers | Decode the recorded version for outstanding work. A temporary internal adapter may serve an existing effect interpreter, but must not become a second emitted contract or a compact replacement for the model's required input. |
+
+A synthetic layout probe used real isolated File/SQLite quota captures and the
+existing TypeScript context codec. Preserving source paths permitted warm delta
+encoding; moving all facts under a new `facts` key while retaining the old
+`quota_packet` surface fell back to full with `delta_not_smaller`. Both layouts
+reconstructed exactly, and an epoch change required full delivery. Retention was
+synthetically asserted; this measures codec behavior, not host observation,
+model comprehension or outcome/cost benefit. It rejects **unmapped root relocation
+under the existing surface**, not nesting in general. A redesigned nested layout
+remains possible if its mapping and consumers justify the migration cost.
+
+Therefore C1/C2 must explicitly version the context surface and its fresh/reuse
+paths with the wire transition. Do not relabel an old surface or inherit its
+baseline by Turn identity. The transition first saves a complete compatible
+source; the model-facing view may already be Progressive. Reuse requires the
+appropriate saved-artifact or retained-model proof above. Qualification includes fields
+outside the old action projection, missing baselines, session/epoch changes and
+same-capture recovery. This resolves a concrete layout risk; shared writer and
+final-consumer replacement remain the next implementation, not another layout
+framework or a declaration that C1 is delivered.
+
+The unfinished implementation candidate [#7430](https://github.com/loopx-project/loopx/pull/7430)
+now composes a complete source in the existing TypeScript owner before both
+quota and native Turn capture, and passes it to actual Codex stdin. Isolated
+File/SQLite CLI tests with a synthetic executable cover source integrity,
+failed-attempt recovery and once-only settlement. This advances the two-writer
+and final-input replacement; it does not qualify C1 cutover. The candidate
+now routes capability reentry through the canonical CLI channel and preserves
+original hash-bound review/writeback readers in complete-contract Codex input.
+Synthetic File/SQLite execution qualifies those readers for fresh obligation-bound
+and prior Todo-bound replans. Native launch now derives its one causal binding
+from the recorded settlement identity; an observed semantic replan obligation
+cannot replace an existing Todo binding. Source-quota and health refusals still
+prevent host launch. Release fixture setup now imports its final source once;
+these executable checks do not qualify a real model or installed host.
+The structured-host renderer now shares complete-input transport with Codex,
+including original hash-bound material readers. Actual isolated File/SQLite
+Turn-to-DSH runner paths receive that same captured source; historical request
+prompts retain their exact content. Structured DSH still has Todo-scoped
+sessions: an obligation-only replan is rejected before dispatch, rather than
+inventing a Todo binding. Full-source input deliberately retains inactive
+capability configuration and diagnostics; those facts do not activate recall
+instructions or reflection result fields. This is a disclosed presentation
+change, with activation and historical parity checked separately.
+The Markdown quota entrypoints now render the same complete contract rather
+than selecting a second subset of facts. Actual File/SQLite CLI captures retain
+every field and instruction under both the ordinary and former envelope flag;
+JSON types and arbitrary source text survive rendering. External-worker
+File/SQLite admission, unresolved-attempt recovery and restart checks pass with
+the complete producer output, but an opaque shell wake still does not prove
+delivery of that original contract to an executor model.
+The real benchmark checkpoint preflight now verifies complete source equality
+for File/SQLite, replan/non-replan and context delivery on/off. Its optional
+full recovery retains that same source, with one initial admission and no
+reader writes. This qualifies transport to the checkpoint's model-input file,
+not native session capture or a benchmark/model outcome. A matching outer
+source hash alone previously admitted an unsupported version or invalid inner
+binding through `replan-view`; the reader now uses the existing complete-contract
+validator, while unversioned historical reads retain their decoder.
+Successor authoring is now bound to the already-decided Turn before complete
+capture, using the same formatting owner as historical staged reads. The complete
+contract includes original Turn/Goal binding and the obligation to finish the
+creation receipt's original settlement before ending, without executing the
+successor. A later modern material read does not append another binding. Actual
+File/SQLite App-heartbeat and generic-CLI tests create the successor from this
+inline contract, reject premature spend, settle the original identity once and
+leave the successor open, without another guard or a staged reader dependency.
+This changes complete-input successor guidance; historical unversioned reads
+retain their old behavior. Settlement-only, capability-intent, unbound and
+mismatched-context inputs retain their authoring unchanged. The checkpoint's
+legacy-reader tests alone do not establish this lifecycle result. Remaining
+material-reader retirement and other C1 consumers must not restore a second
+compact executable fact view merely to satisfy historical assertions.
+The complete-contract boundary now rejects unknown, empty or mistyped root
+execution actions, using the existing decision/frontier vocabularies both
+before capture and on later reads. Valid hashes do not make unknown execution
+semantics supported. Optional evidence remains intact, including unfamiliar
+versions and action-like field names; historical unversioned action routing is
+unchanged. This qualifies the root action boundary, not every required semantic
+field. A real File/SQLite native-CLI producer fault is rejected before capture,
+dispatch or spend. The preceding candidate reached a later launch refusal;
+these probes do not show prior unguarded execution. Selected-work tests now consume the complete interaction context and
+use the actual native `turn plan` entrypoint for host input. Real File/SQLite
+checks retain full task text, canonical notes, scoped gates, fresh requirement
+reads and source-loss recovery without rebinding an App capture to a native
+host. The six earlier failures at obsolete root-layout assertions remain
+historical failures; their downstream semantic checks now execute.
+The six earlier staged-reader failures are retained as historical evidence.
+The complete composer now reuses Explore's existing applicability correction
+before capture: a proven pure replan without a Todo does not advertise the
+Todo-bound result attachment. Evidence, independent graph commands and all
+before-work obligations remain; unfamiliar/custom instructions and ambiguous
+bindings stay intact. Supported Todo-bound attachment authoring remains fully
+inline. This is an applicability correction, not an authority change or a new
+compact fact view. Real File/SQLite native host inputs qualify both bindings.
+The staged tests now consume the complete CLI input and exercise the historical
+material-reader codec against that same immutable capture, including a hostile
+PATH, unavailable registry, tampered identity/acceptance and the actual writer.
+They compare all successor-binding instructions rather than excluding fields
+that the complete input now owns. The attachment refusal fixture supplies a
+valid explicit finding status so it reaches the real missing-Todo identity gate.
+All 23 staged checks and four native host cases passed; these overlapping scopes
+do not establish full consumer retirement or packaged-host qualification.
+The native context fixture now binds both CLI spellings to `complete_turn` and
+compares reconstructed facts with the original captures. Its four initial
+failures came from constructing the restoration oracle with retired surfaces;
+a Unix rendezvous check had masked the same mismatch by accepting full fallback.
+The corrected checks require the original target and actual delta mode. Ten
+cases pass through real Codex exec/app-server/code-mode and worker resume with
+isolated SQLite and deterministic loopback inference, including compaction,
+process resume, replaced history and an unqualified replay profile. No paid
+model or benchmark experiment ran. The current full quota-settlement CLI module
+passes 158 checks, including the historical cache-parity case; the earlier
+intermittent mismatch is not causally explained or relabeled as a pass.
+The File/SQLite context-to-DSH subprocess checks now use the complete capture and
+production request builder instead of treating a current CLI response as a legacy
+action projection. Normal capability-on/off inputs retain every source fact;
+bound replan uses the production capture binder and executes the delivered
+original-evidence readers. Altered source facts, schema versions and replan
+obligations reject before the runner seam. The explicit historical reference
+reader remains covered. Eight focused cases pass with an injected recorder,
+not a live DSH model; runtime code is unchanged by this test migration.
+The complete-contract boundary now also reuses the existing interaction decoder
+for its required version, channel types, notification policy and execution
+consistency. Four negative cases previously passed composition despite invalid
+semantics; they now reject even when a producer supplies correct integrity
+hashes. The original object and unknown optional facts remain intact rather than
+being replaced with normalized decoder output. File/SQLite native input checks
+reject an unsupported inner version before Codex prompt execution or DSH runner
+loading, without spend. The complete-contract/context/DSH/stdio selection passes
+352 cases; TypeScript checking and focused lint pass. This qualifies these
+interaction semantics, not every required field or packaged-host adoption.
+Remaining cache consistency investigation, other old reader expectations, staged instruction parity and
+actual optional/external consumers, version admission and packaged host
+continuity remain unfinished. Operation-SDK checks without an explicit native
+runtime are untested, not qualified. The default writer change remains
+unshipped; the PR is Draft for unfinished author work, not merely pending review. No model or cost benefit is
+established. Historical effect decoding is temporary; it must not become a
+second permanent executable view.
+
+### C1 caller replacement and cutover unit
+
+The cutover unit is a supported entrypoint **and its downstream consumers**,
+not an output flag. Source inspection at `99921829f2c5` identifies the following
+live seams. This supplements the earlier baseline audit; it is a migration
+design, not a claim that these paths have changed.
+
+| Live seam | Concrete replacement and retained owner |
+| --- | --- |
+| `quota.py::_emit_quota_result` / `_project_quota_cli_payload` | Compose the complete contract before capture; replace the ordinary/envelope execution-format branch. Retain admission, capability hooks, capture IO and host poll receipts with their current owners. A diagnostic status view is not an executable contract. |
+| `turn.py` after `build_fresh_turn_decision_owner().resolve()` | Call the same composition owner with the actual scheduler execution context. This entry calls `build_turn_envelope` directly; changing quota CLI emission alone does not migrate Turn. Retain the Turn plan, journal and receipt executor. |
+| `heartbeat/task_body.py::render_thin_heartbeat_task_body` | Replace the `captured_envelope` instruction split with one contract-reading instruction. Preserve exact selection/reentry transport, notification independence, required reads and original settlement. The saved bootstrap still resolves current instructions on wake. |
+| `turn_driver/codex_cli.py::_prompt` and `host_candidate.py::extract_turn_authority` / `render_prompt` | Replace format-specific model inputs at the actual prompt boundary. Today ordinary Codex receives the envelope, staged replan uses extracted authority, and structured hosts use extracted authority. Shared source bytes or signatures do not prove these final inputs preserve the same obligations. Keep provider result encoding and outer effect ownership. |
+| `turn_driver/decision_capture.py` and `cli_commands/quota_capture.py` | Reuse immutable capture, validated readers and full/delta delivery. Fresh delivery and saved-capture recovery must reconstruct the same contract; do not reuse a continuity baseline for a different projection merely because its Turn identity matches. |
+| `benchmark/runtime/worker.py`, `benchmark/runtime/sessions.py` and `scripts/external_scheduler_worker.py` | Migrate the product entry they actually invoke. Keep evaluation setup and outer wake ownership; do not add benchmark-only conversion or count a managed-host test as attached-host acceptance. |
+
+Before replacing any seam, its implementation PR records source path, field or
+instruction clause, current readers, target owner, representation, recovery and
+retirement condition. Relocation must include reference resolution; an omitted
+diagnostic needs evidence that it carries no action, authority, required read or
+acceptance obligation. Unknown data cannot silently disappear. Unknown required
+execution semantics cannot be made safe merely by forwarding their JSON: the
+dependent operation stays unavailable until a compatible consumer understands
+them. Do not classify obligations by substring matching.
+
+Use **one explicit version transition**, not automatic format negotiation per
+wake. New admission for a migrated binding requires compatible composition,
+delivery and consuming readers. An unsupported consumer receives an actionable
+unavailable result before dispatch, without creating a second live writer.
+Already admitted work continues its recorded version and original receipts;
+retain its historical decoder until that work and the supported recovery window
+are reconciled. Rollback likewise separates outstanding work from new admission.
+A version transition does not rewrite saved prompts, journals or source hashes
+as if they had always used the new contract.
+
+The first C1 PR must include the two production composition callsites above and
+at least one complete producer-to-final-input journey, with an explicit list of
+remaining readers. Qualifying that bounded slice does not enable the new writer
+for an unqualified host or close C1. The final cutover removes active format
+choice only after all supported readers qualify. Temporary decoders have named
+callers and removal conditions; they are not user-facing compatibility views.
+
+For each normal, selection, replan, wait, recovery and capability-off fixture,
+check independently authored obligations at **three boundaries**: composed
+contract, reconstructed delivery, and final model input plus required material
+reads. Include a source change outside the old action signature, a missing
+required source, an incompatible consumer and a lost settlement response.
+Reconstruction equality alone misses prompt-layer omission; a complete prompt
+alone misses stale authority or a duplicate debit. These are integration
+requirements, not authorization to run a model or launch an experiment.
+
+1. Inventory actual producers, readers, writers, saved prompts, captures and
+ external integrations. Map each old field and prose obligation to its retained
+ owner/field, authoritative derivation or explicitly approved removal. No
+ blanket claim of “same facts” suffices. Keep original failure fixtures.
+2. Qualify the unified contract in single-session execution through real quota,
+ thin-heartbeat and Turn entrypoints. Switch one writer per binding; old
+ readers are explicit version-pinned migration adapters with an identified
+ caller and removal condition. They do not become permanent product views.
+3. Add role-aware sessions, shared lifecycle reuse and the opt-in two-session
+ profile. Reuse existing same-session/native-resume and effect recovery code.
+4. Adopt the shared product profile in benchmark workers and the packaged App
+ heartbeat journey. Each host proves its own observation, stop and recovery
+ boundaries. Neither a CLI test nor a model simulation qualifies installed App.
+5. Remove old producers, format selectors, duplicate renderers and dual-format
+ tests after the last supported active reader migrates. Keep only historical
+ version decoders for supported receipt replay. End-state acceptance requires
+ one emitted contract and no choice between quota and Turn packet formats.
+
+Rollback disables new admission for the affected profile, drains or interrupts
+its attempts, reconciles receipts and restores the prior qualified profile on
+the next admitted work. Do not silently replace native sessions or reinterpret
+pending receipts. Before field/decoder removal, demonstrate export, old-version
+readback and downgrade behavior; retain the old reader until the supported
+retention/upgrade boundary is satisfied. No destructive migration is authorized
+by this document alone.
+
+### C1 baseline boundary and reuse inventory
+
+The baseline is the **original caller-visible quota delivery**, not the raw
+internal decision. In `cli_commands/quota.py`, the original emitter captures the
+source, optionally applies `replan_cli_view` when a capture exists, then applies
+`compact_quota_should_run_cli_payload`. Native context delivery adds its own
+full/delta transport afterward. Record the exact revision, host flags, capture
+availability and detail options for both arms. Comparing a compact candidate
+against the larger internal source would overstate savings; comparing a full
+candidate against only a deferred entry would omit baseline follow-up costs.
+
+The existing paths already contain useful efficiency behavior. C1 should absorb
+its qualified semantics into the shared TypeScript composition/context owners,
+then retire the old caller-specific producer. Do not call the whole legacy
+compactor as a shortcut: exact sharing, omission and deferred reads have different
+information and failure consequences.
+
+| Existing information / transformation | Fusion disposition and decisive check |
+| --- | --- |
+| Selected work, original requirements, acceptance, evidence, permissions and stops | Available before the dependent decision. Keep distinct revisions and contradictory evidence; neither lane labels nor action signatures establish completeness. |
+| Identical acceptance copies, nested vision audits, authoring and optional guidance | Prefer one complete in-contract owner plus an exact reference where smaller. Compare JSON types and every clause; different/missing owners remain distinct. No extra read or new decision authority. Existing projection tests provide characterization, not new-consumer qualification. |
+| Bounded Todo lanes, shortened suggestions and omitted boundary/history entries | Treat as deliberate omission, not lossless deduplication. Retain completeness/count facts and same-capture recovery; prove the omitted item cannot change the current decision, or load it before deciding. Never inherit the old display limits as semantic limits. |
+| Captured replan review, acceptance detail and writeback readers | Separate decision facts from later authoring format while retaining the original identity and all required meaning. Bound reads to the same capture; count every required stage, error and recovery. A missing/stale reference must not trigger a new guard or authorize work. |
+| Full/delta/resume delivery | Reuse the existing continuity owner after composition. Establish exact semantic reconstruction and required material availability before action; charge cold fallback and lost-baseline recovery. |
+| Scheduler, admission and settlement identities | One authoritative instance before capture; transport must preserve host ownership, original Turn and once-only effects. Repeated representations do not justify weakening their checks. |
+
+A standalone late move of acceptance sharing is not automatically a useful
+prerequisite. A controlled source-level substitution against main
+`99cfa3ac559bfa237f04f36fb7e926672fea44b2` moved only that rule from the local
+CLI compactor into the existing `reference_context` call. On the same synthetic
+fixture with 100 distinct requirements, serialized projection input grew from
+102,680 to 344,010 bytes; the 102,189-byte caller-visible output stayed equal.
+The ordinary path still made one projection call; all-details delivery changed
+from local sharing to one call. These are projection-parameter measurements,
+not framed traffic, latency, model billing or the integrated C1 comparison.
+Retain this negative result rather than declaring a net efficiency win.
+
+The compatibility owner also uses one local JSON serialization identity for
+acceptance, Vision-audit and replan-authoring sharing. Python's ordinary value
+equality must not turn distinct booleans/numbers, integer/float representations
+or signed zero into an alias to another observation. Exact copies still share
+one in-response owner, including after key reordering; different facts remain
+complete. This repairs source fidelity without another projection RPC. It does
+not qualify the unified writer, final consumers or original-quota outcome/cost
+benefit.
+
+Repair relocated acceptance aliases at the current compatibility owner without
+that extra transport. Existing aliases must follow only inline owners actually
+moved by the projection, including aliases visited before their owner. Preserve
+complete values, original numeric types, carrier order and existing size checks;
+never infer arbitrary reference chains or rewrite saved captures. The complete
+C1 composition must absorb this rule at its source-owning boundary and retire
+the Python compatibility algorithm with its callers, rather than repeatedly
+shipping all acceptance copies across another bridge. Writer/consumer cutover
+and the original-quota outcome/full-cost gate remain open.
+
+A fixed-source synthetic replan audit of candidate `895f38fc5` illustrates why
+the boundary matters. With stride off and no capture staging, the raw source was
+21,461 compact UTF-8 JSON bytes, the original quota CLI projection 20,543, and
+the complete candidate 21,738: **+5.82% against CLI**, versus +1.29% against raw
+source. With capture staging, entry/review/writeback totaled 21,882 bytes versus
+21,821 for the candidate. With `evidence_conditioned_v1`, those staged bytes
+totaled 28,558 versus 33,368 for the candidate. These use the existing synthetic
+replan fixture and production projection/read functions with a synthetic capture
+route; they are not executed model trajectories or an installed-host trial.
+Extra acceptance/Explore reads, actual request framing, cache behavior and
+outcome differences are unmeasured. The legacy receipt toggle produced identical
+data and does not add an independent workload. No net-benefit conclusion follows.
+
+The next implementation slice should first qualify exact same-contract sharing
+through composition, readers and recovery, then assess deferred-detail choices
+with the matched workload above. Keep cold and staged totals separate and retain
+negative results; do not force a byte target by dropping unique instructions.
+
+Report the field/clause diff and its decision consequence together with actual
+model input, cached/uncached tokens, added reads/round trips, reconstruction,
+latency, failures/retries, verification and human intervention. A smaller first
+packet with more total reads can be negative. Judge positive only with preserved
+required semantics and comparable accepted outcomes at lower complete cost, or
+better accepted outcomes at comparable budget. Mixed results remain a tradeoff;
+transport-only passes and unmeasured outcomes remain inconclusive. Set numeric
+criteria before running matched experiments, using the existing measurement
+contract rather than inventing an arbitrary compression threshold. C1 cutover
+requires this quota-baseline comparison; a serializer or byte reduction alone
+cannot close it.
+
+Use the [existing measurement model](../long-horizon-harness-benchmark-research-program-v0.md#6-measurement-model).
+Include both sessions' input/output/cached tokens, tool and material reads,
+planning/replan/recovery, wall time, verification, human attention and provider
+cost; unknown usage is not zero. Persist causal attribution without duplicating
+cost when an artifact is forwarded. Compare accepted outcomes under comparable
+budgets, not only replan counts or executor speed. Freeze criteria before any
+separately authorized experiment; this RFC specifies no automatic winner.
+
+For the later two-session comparison, attribute controller reasoning and all
+handoff/material, validation and recovery costs as well as executor work. The
+break-even question is whether those **added complete costs** are outweighed by
+avoided control/bookkeeping work, repeated execution or human intervention,
+while preserving comparable accepted outcomes. Account for actual repeated
+model consumption even when both sessions read the same artifact; forwarding
+one usage receipt must not double-count that receipt. Report workload-specific
+tradeoffs and unknown billing/cache coverage. No universal overhead threshold,
+compression ratio or per-message token ceiling is proposed. This comparison
+does not replace the prior original-quota versus unified single-session gate.
diff --git a/docs/architecture/rfcs/controller-executor-unified-contract-v0/contract-and-context.zh-CN.md b/docs/architecture/rfcs/controller-executor-unified-contract-v0/contract-and-context.zh-CN.md
new file mode 100644
index 0000000000..54feab7b88
--- /dev/null
+++ b/docs/architecture/rfcs/controller-executor-unified-contract-v0/contract-and-context.zh-CN.md
@@ -0,0 +1,513 @@
+# 契约与上下文迁移：Controller RFC 技术附录
+
+本文属于[主 RFC](../controller-executor-unified-contract-v0.zh-CN.md)，保留其字段、读取、历史证据和切换要求，
+不是新的 RFC、任务队列或另一套架构。先阅读主文的系统图和当前交付路径，再按需进入这里。
+历史实验仍绑定各自 revision；其中的“当前”描述只适用于该记录，不能覆盖主文最新核对。
+
+### C1 源码核对：已有共享 owner 与剩余分叉
+
+绑定 Turn 的原生执行准备保留普通 managed claim 原引用，并在 CLI 压缩前捕获同一
+Turn 的 ready 决策。Host 将该原件交给既有 saved-capture 展示/reader owner，不丢弃
+它再要求模型重算 guard 才能取得当前契约。发布前须核对 Goal、Agent、Todo 和 Turn。
+必需材料读取（包括显式的完整 Goal 读取）仍须执行，ready 回执或已保存文件不能代替
+读取。可选展示失败保留原摘要绑定的恢复引用；显式 off 不产生动作，未绑定请求沿原
+readiness 路径，不补造 Turn。这只是有界的 Host 交接修复，不代表 C1 切换、已安装
+采用，或模型费用与长程收益已取得资格。
+
+源码实际共享的部分比输出名称体现的更多。`_emit_quota_result` 在
+`_project_quota_cli_payload` 选择普通 CLI 压缩或 `buildTurnEnvelope` **之前**，
+已经捕获完整决策。后者委托 TypeScript owner，Python 模块是传输 adapter。
+Quota capture 与 Turn journal capture 都调用
+[`decision_capture.py`](../../../../loopx/control_plane/turn_driver/decision_capture.py)
+中的 `write_decision_capture`。原生上下文交付与显式宿主 handoff 也复用该模块和既有
+context-delivery owner。C1 应收敛剩余的组合逻辑与消费者假设，不另建 capture service，
+也不重写已经共享的差分与 native-resume 逻辑。
+
+可选 host poll 也是该次原始观测的一部分。来源保真切片在 capture 前仅记录一次
+`--record-host-poll`，普通 CLI、envelope 与原生上下文交付复用同一回执；恢复读取不再
+轮询。后续 capture/handoff 失败的错误响应仍携带已记录观测，不表示缺少准入，也不
+授权重放。默认关闭行为和不可读回执诊断不变。这只修复 capture 完整性，不代表统一
+writer/consumer 切换或长程成本收益已取得资格。
+
+独立的原生展示切片复用已提交的完整恢复原件作为 reader 目标，避免再次发布未使用的
+wire 副本。Delta 与未包装输入仍保留各自的不可变文件，reader/lifecycle owner 不变。
+同一 107,289 字节合成来源的 capture 写入从 216,754 降为 107,289 字节；完整 reader
+字节及 3,937 字节的 warm delta 均不变。这只验证重复 capture IO 的消除，不证明模型
+输入减少、完整成本收益、成果验收或 C1 writer/consumer 切换。
+显式小预算下，原生展示还可省略重复的目录/选读快捷命令，保留完整恢复命令；
+在其后追加 `--list` 或 `--select`，无须基线即可发现或读取当前事实。
+原有 4,000 字节冷态、温态及压缩恢复用例保留完整要求、Stop、原身份和完整恢复；
+这属于传输验证。
+
+Journal 持久化是独立的来源保真前置。本次提议由 Python adapter 复用 context
+delivery 的稀疏数值 token 收集器；两个 TypeScript 消费者复用同一来源数值校验器。
+Journal 继续传递 JSON 对象，仅为整值浮点、带符号零和非安全整数增加元数据。
+Journal owner 在原子发布前恢复这些数值，并在重放与不可变 plan 比较中保留其
+区别。普通原生对象保留已有编码，不改写历史回执。
+
+中间的完整 JSON 字符串方案，在合成的 155 万字符带引号正文上超过既有 2 MiB
+请求边界；原对象路径能够接收同一负载。保留这一负面结果：稀疏替代须在相同
+负载与上限下比较，包括数值密集时的元数据开销。该前置或组件字节减少，都不
+构成统一 writer/consumer 切换或长程净收益的资格。
+
+本次提议的 Turn 选择 reader 切片删除 driver 中 Python 的 adaptive 选择判断。
+现有 plan、Host、Session、completion 和 settlement 调用方经既有 source-edit
+传输复用 interaction owner 的 `selectedWorkTodo` 规则。此选择 adapter 仅保留
+Python 标量与空白解码，原记录和数字值不变。这退役的是一条重复规则，不是历史
+envelope 格式；完整 writer/consumer 切换和相对原 quota 的成果／完整成本资格仍
+开放。新增 bridge 调用必须计入，代码收敛本身不证明成本降低。
+
+| 当前来源 / 义务 | 当前 envelope 处理 | C1 必须保留的归属与语义 |
+| --- | --- | --- |
+| `interaction_contract.agent_channel.work_context` 与未完成必读 | `work_context` 加 `required_reads`；相同内联材料可改用引用 | 一份完整要求/证据来源与可解析引用；保留未完成必读及其完成条件 |
+| 选定 Todo、recommended action、action portfolio 与 planning horizon | `action`；`turnActionProjection` 进行引用迁移与文本压缩 | 一份选定工作/动作身份；保留完整可执行条款，区分摘要与执行指令 |
+| `interaction_contract.cli_channel.settlement_plan` | 复制至 `writeback.settlement_plan`，包含原 effect 身份与条件步骤 | 原样复用 settlement owner；controller 对话和新 capture 都不另建扣款身份 |
+| User/agent interaction channel、execution policy 与 task orchestration | 分为 `user`、`execution_policy`、`boundary` 与 orchestration 分节 | 保留通知与执行义务的区别、权限和停止 gate；不从正文猜测 |
+| Replan packet、必读与分阶段写回 | 专门的 replan 投影与延后写回 | 保留事实/来源访问、policy 特定触发与有序变更；不统一打开 stride 行为 |
+| Scheduler context 与执行归属 | 携带调用方执行上下文的 scheduler 投影 | 保留真实宿主 owner 与 ACK 义务；统一 schema 不转移 scheduler 权限 |
+| 完整已保存决策、action signature 与 journal 绑定 | 来源 hash、投影动作 hash、captured-decision 引用分别存在 | 区分语义完整性、精确传输字节与回执身份，不互换 hash |
+
+这份表是 owner 与义务映射，**不是完整字段清单，也不是等价验证结果**。当前投影有文本
+预算、字段白名单和引用迁移；仅比较 action signature，不能证明完整来源条款与未知字段
+都被保留。C1 实现必须按确切 base/head 枚举字段和调用方；未分类项阻止切换，不能以
+假定的兼容视图为由悄悄丢弃。
+
+对上述基线的合成探针展示了这一限制：两段前缀相同、尾部不同的长 `recommended_action`
+产生相同的 action-signature document，且均返回 `matches=true`，但各自的
+`source_decision_hash` 不同。未注册的顶层来源字段也有相同区别。反之，完整的已注册
+settlement plan 在投影中保留，改变其 Turn 身份会改变 action signature。这些观察
+排除了直接把现有有界 envelope 原样提升成完整契约的路线，**不证明当前发生权限丢失**：
+recommendation 属于诊断，未知字段是合成输入，完整来源承诺仍能区分两份输入。
+没有测量模型收益。
+
+### 差分上下文
+
+复用现有 context-delivery owner 与不可变 capture 机制。目标包含两个正交层，
+二者都不创建第二个语义 producer：
+
+- **Layer 1 — Progressive：** 面向模型的交付默认跨 LoopX Host 生效，包括没有
+ Session Hooks 的普通 CLI、MCP/HTTP 和外部 worker。当前 Goal、适用的累计验收、
+ 失败/未知、权限、停止条件和未履行读取/结算义务保持内联。历史、来源正文和评审证据
+ 等重材料，只能经既有 typed composition owner 折叠，提供精确的当前 capture 读取
+ 路线，并明确依赖工作前的读取义务。相关性/schema 未知时保留完整必要材料。这是
+ 交付默认值，不授予额外采集或持久化权限。调用方没有可用且获授权的 reader 时交付
+ 完整内联上下文；本地文件路径不是可用的远端读取路线。Host 硬限制使两种路线都不可用
+ 时，明确上下文不可用并阻止依赖工作。
+- **Layer 2 — Delta：** 对组合后实例进行精确编码，仅在 consumer/session、role、
+ epoch、schema 与来源绑定已资格化的 Host 自动选择。Progressive 可以用 full 编码，
+ 完整内联实例也可以用 Delta；连同 Progressive + Delta、二者都关闭，共同验收四种
+ 组合。Host 没有合格连续性时，对 Layer 1 使用当前 full 编码，不丢失 Progressive，
+ 也不虚构 native session。
+
+区分两种已有复用主张。**`captured_file`** 比较已验证且兼容的不可变落盘产物；
+精确重建不要求模型先读旧文件、到达 EOF 或保留其内容。**已保留模型输入的复用**
+只有在精确 consumer binding 下存在可信完整送达和 retention 证据时，才能省略此前
+交付的正文。文件落盘、工具输出回执和模型自我确认不能建立这种证据。Session Hooks
+只观察受支持边界，不授予新权限。保留删除、数组顺序、null、空值、原始数值和完整
+字符串；未知字段在注册复用语义前保持完整。先发布当前完整恢复源，再交付可选视图或
+差分；验证重建，Delta 加元数据不更小时选 full。Layer 1 也将最终序列化 UTF-8 视图、
+读取说明和索引，与同次 capture 的完整替代交付对比；选择更小的有效交付，不能为满足
+体积预算而裁掉必需含义。
+
+当前权限、准入、取消、未完成必读、结算与 scheduler 事实即使未变也新鲜内联交付，温态
+传输不能减弱正文义务。Delta 缺失/乱序、基线损坏或未知时，选择当前 full 编码/恢复；
+读取截断或丢失时，从同次 capture 恢复必要范围。上下文压缩使下个工作 Turn 在新基线
+epoch 中的 retention 失效；它不使现有 Turn 失效，也不要求预读旧包或立即全量重读。
+保留原准入、恢复引用和一次结算/扣额。执行仍检查来源有效性与当前权限；恢复旧 capture
+不能复活已取消工作。Executor 任务对话独立消费语义材料，不是 controller Core packet
+换名后的 delta。
+
+#### 跨 Turn 未读材料
+
+当前不可变 capture 已支持精确选读。待补设计是跨交付显式发现未读材料，不是第二个
+reader，也不是先读完整基线。扩展既有 context/readback owner 与原生 `session.json`
+投影；其他 Host 使用相应 consumer binding。区分产物发布、模型可见交付覆盖、
+retention，以及语义采用/验收成果。
+
+`confirmed_read_sections` 是提议的覆盖投影；若保留 `consumed_pointers` 这个名字，
+它必须从同一 owner 派生，不能成为第二本台账或暗示理解。证据绑定精确 source/capture
+digest、revision、consumer/session role、epoch、schema 和选读 pointer/range。
+仅凭可信 Host 对实际模型可见结果的观察确认覆盖。调用 `--select`、文件存在、reader
+EOF、成功工具日志或模型自我 ACK 均不足。部分/截断/丢失输出保持未确认；选择父节点/
+索引不能确认隐藏子节点。没有此类 observer 时覆盖为未知，发现保持保守。这种覆盖
+绝不能成为 `captured_file` Delta 的新增全量读取门。
+
+每次 warm 交付携带 **`unread_context_index`**（提议名称）：列出符合交付范围、未内联且
+当前内容未确认或已变更的材料，包括被 Delta 省略的未变正文。给出精确当前指针、来源
+版本/digest 和必读状态，不能凭摘要推断相关性。已确认范围只适用于观察到的版本；
+内容变化、数组重排或映射不明须重新绑定当前来源并保守发现。确认送达不证明输入已保留
+或语义已采用。
+
+每项通过既有 `quota context-read --select`，绑定精确 capture SHA，从**当前完整不可变
+`projection.json`** 独立读取，不依赖上一包、基线文件、模型记忆或 patch 链。派生的
+`required-context.json` 或 wire 视图保留既有 owner 对规范来源的显式映射，不能混用
+根路径和 digest。历史精确版本回查仍属于单独绑定版本的产物/读取契约，不能虚构路径
+别名或借此静默使用旧事实。前轮材料仍属必需却不在新 projection 中时，由原 owner
+带入当前 capture，或暴露当前获授权的来源/读取义务。合法过期、撤权或移除须显式保留；
+必需材料不可用则阻止依赖工作，不能静默记作已读或永久保留禁止保存的原始数据。
+外部材料仍遵循自己的来源消费契约。
+
+#### 配置与迁移
+
+下表是提议行为，不改变当前限定 Codex 的 `context_delivery` on/off 接口。演进既有
+typed 配置 owner，表达两个层的决定；由 C1 在实现前映射精确名称和版本，不新增平行
+配置存储或 packet 格式开关。
+
+| 配置 / 调用方 | 迁移与生效行为 |
+| --- | --- |
+| 面向模型、没有持久偏好的调用方 | 该调用方 reader/回退及成本验收后使用目标 Layer 1 默认值；Layer 2 仅在连续性已资格化的 Host auto，否则 full 编码。在 rollout 合格前，普通 CLI/其他 Host 仍保持当前 full 行为。 |
+| 显式调用参数/环境 off | 保留当前优先级，本次调用 full/raw 交付，不依赖可选 codec/覆盖台账，不改写持久偏好。 |
+| 已持久化 off | 保留完整 off 路径及原读取/恢复义务，不能借“无偏好”迁移把它变为 Progressive 或 Delta。 |
+| 已有 on、受支持 Host | 映射为 Layer 1 + 已资格化 Layer 2 auto 时，保留合格的原生文件/恢复语义，不增加模型全量读取前置。 |
+| 已有显式 on、不受支持 Host | 兼容期间保留当前校验错误；按版本发布且调用方验收后才可提供受支持的 Layer 1，不能静默重释不受支持请求。 |
+| 新的独立分层配置 | 独立遵守各层，包括 Progressive off + 合格 Delta auto；显式 Delta off 仍保留 Progressive；不受支持的 auto 回退当前 full 编码。 |
+| 内部 raw machine 消费者 | 保留显式 `--context-delivery off` 契约，不把机器 JSON 换为模型文件引用，不修改偏好。 |
+
+冻结已记录版本、实验配置与历史回执。扩大默认值属于行为变更，须验证真实调用方、
+显式 off 隔离与失败/恢复；设计合并本身不改变默认值。
+
+#### 交付验收
+
+复用 C1/C2 真实入口和第 9 节对照，覆盖以下决定性案例：
+
+| 案例 | 必须观察到的结果 |
+| --- | --- |
+| 无 Hook 普通 CLI 及受支持 MCP/HTTP/worker 路线 | Layer 1 经真实获授权 reader 或完整内联回退可用，不留下仅本地可用的悬空引用，不虚构 native epoch。 |
+| 未变的未读末尾在下一 Turn 成为决定性约束 | Warm Delta 可省略其字节，但当前索引须暴露完整来源，后续实际选择/工作遵守恢复的约束；仅索引可见不能算成功。 |
+| 变化/未读正文、数组重排、未知字段或 scope | 绑定当前来源，保留适用跨 Agent 义务及未知范围的完整回退。 |
+| 部分页、工具输出丢失/截断、EOF 但无 Host 见证 | 不确认不可见字节或隐藏子节点；恢复缺失范围，未知覆盖保守进入索引，文件 Delta 仍可用。 |
+| 压缩、role/session/schema/epoch 变化 | 使不兼容 retention/复用失效；恢复当前事实，不重放原准入、effect 或扣额，不预读旧包。 |
+| 来源撤权、reader 不可用、材料合法移除 | 遵守当前权限/来源 owner，暴露丢失并阻止依赖工作，或使用获授权完整回退，不泄露旧数据。 |
+| Full 更便宜、off 与旧配置 | 选择有效 full 交付，保留显式 off 和冻结版本，并观察来源身份及 raw machine 消费者行为一致。 |
+
+正文文件缩减率主指标为 **`1 - V/F`**：`F` 是完整 capture 的实际 UTF-8 文件字节，
+`V` 是同次 capture 所选视图正文文件的实际字节，节省字节为 `F - V`。绑定两个产物及
+digest，wire/索引开销单独报告，不能改换分母；上文交付体积保护仍计入实际呈现开销。
+净收益主张还须计入后续全部读取/恢复、Host/controller/executor 调用与延迟、实际
+tokenizer/cached/output 用量、人工注意力和验收成果。保留不利案例和冻结预算。
+包更小本身不能证明 token 成本更低或成果更好；第 9 节原 quota 单会话对照仍为主，
+双会话成本单独比较。
+
+### 按决策阶段交付候选上下文
+
+Canonical capture 保留完整候选上下文，由同一 C1/C2 owner 按消费者实际要做的决策
+交付。本节提出替换契约，不允许跳过已有必读项。当前 capability gate 将选择交给
+Agent；`selected_todo` 投影或列表顺序本身不能证明比较已经完成。在消费者与恢复义务
+一起替换前，保留 [#7557](https://github.com/loopx-project/loopx/pull/7557) 的完整
+上下文修复。
+
+| 决策阶段 | 依赖决策前必须取得的输入 |
+| --- | --- |
+| 选工作或重新考虑选择 | 完整、可发现的候选索引：身份/版本、原目标、已声明的 Goal 贡献、优先级、资格、归属、依赖/阻塞、当前证据/不确定性和同次捕获详情引用。缺失事实保持未知。比较备选项前读其完整详情；索引不能判明某项是否相关时，先展开再选择。不能静默只保留 top-K。 |
+| 继续已准入工作 | 完整当前任务、原始和累计要求、适用的全局/共享约束、依赖、反证、当前权限与停止条件。注册的继续执行契约可延后独立备选项，同时暴露可能触发重新考虑的新资格/资格变化和证据。仍被要求在全部 runnable 候选中选择的 Agent，依然处于选择阶段。 |
+| 重规划或验收 Goal | 展开全部受影响工作与验收，包括跨 Agent 依赖和冲突证据。范围未知时展开完整捕获依据；归属和之前的局部完成不能证明无关。 |
+
+这些是消费者义务，不是三套 packet schema 或新 scheduler mode。Typed owner 按明确
+契约决定哪些读取可延后，Agent/controller 负责语义选择。作者提供的目的或风险摘要
+帮助发现，不能证明省略正文无关。不按关键词、领取标签或模型评分推断相关性。缺少充分
+typed 事实时，比较仍可能需要所有正文；冷态选择不承诺压缩比例。普通工作默认展开当前
+Agent 的 outcomes、让其他成果可发现是有用的；共享要求、依赖、冲突证据和未知关系
+必须突破默认范围。Outcome scope 与候选选择保留各自 owner。
+
+扩展既有不可变 reader，从**同次 capture** 批量读取所选详情，保留各请求项的版本、
+来源、完整性、覆盖与游标。同 Todo 不同版本仍分开。详情缺失、截断、不受支持或变化时
+阻止依赖工作，使用该 capture 的完整恢复；fresh guard 不能充当详情 reader。一次
+读取可交付多个正文，受支持的保留会话内无需重复交付已验证正文。读索引不等于确认隐藏
+正文已读。已保留模型输入的复用仅覆盖实际送达且保留于该消费者的正文；文件 Delta
+遵循上文独立产物证明。新成为必需的详情必须提供正文，不能因为机器已经存有它而省略。
+上下文丢失恢复必需模型产物，范围未知时扩大到完整来源。
+历史 capture 保留原义务。读取回执证明覆盖，不证明理解、保留、新鲜权限或验收。
+
+单会话 Agent 消费同一管线。Controller/executor profile 中，由 controller 比较备选项
+并承担 Core 记账；executor 经既有 host 通道取得完整当前工作与授权材料。它不会成为
+Core 客户端，也不用接收全部备选项来弥补 brief 的缺失。复用 capability 资格、
+work-context/读取履行、capture/detail 与 delta owner，不新增候选存储、Python
+相关性规则或逐项审批往返。
+
+在相同输入上，与原 quota 单会话和修正后的完整上下文对照。覆盖：初始未展开候选末尾
+的决定性约束、展示上限之外的有价值备选项、peer 证据变化、阻塞项变为可执行、同标题
+不同要求、缺失元数据、上下文丢失及批读失败。实际选择与后续已验证工作必须遵守约束；
+可重建 JSON 或 selected ID 不变不足以通过。计入从首轮输入到验收成果的全部详情读取、
+分页、重试、恢复、两个会话的调用、延迟和人工介入；保留分阶段交付更昂贵的小任务与
+冷态选择反例。字节与使用真实模型 tokenizer 测得的 token 分开报告。
+
+交付仍归 C1/C2：先由真实 caller 验证共享同 capture reader 与必读恢复，再将该 caller
+的阶段交付和义务一起替换，最后验证 retained delta 与可比成果/完整成本。复用
+[#7560](https://github.com/loopx-project/loopx/pull/7560) 的 outcome scope 工作，
+不能将 outcome 关系当成候选选择证明。
+[#7587](https://github.com/loopx-project/loopx/pull/7587) 的诊断计数折叠是独立兼容
+切片，不代表本次替换。每个切片可有独立 PR 与回退，不要求通用检索框架或启用双会话。
+
+原生 quota caller 现已实现有界的验收材料切片：已知的累计目标、完整验收要求描述和
+当前评审状态保留在必读视图；来源历史与评审说明/证据可以从原始不可变 capture 按需
+读取。读取义务、全量/差分基线与恢复共同切换。选读详情不能履行隐藏的必读内容，
+也不能建立完整基线。未知语义和签名 envelope 保持完整，关闭路径不变。Typed 路径
+计划不让原始 capture 数值经过 JavaScript 往返转换。
+若必读视图加详情索引的 UTF-8 序列化字节数并未减少，则保留全量交付和原始义务。
+默认详情示例选择来源、说明或证据字段，避免重放整个 outcome。
+
+原生 exec 与 code-mode fixture 还验证了同一工作 Turn 内连续两次压缩：充分的工作
+摘要可以保留原始工作/结算身份继续推进，无须重放 packet 或重新准入。基线仍失效；
+尚未完成的初次读取和缺失的必要事实仍需从同一 capture 恢复，新工作 Turn 则取得
+新的 guard。这是确定性 inference 下的原生协议资格，不是模型遵循性或真实成果/
+成本收益的证据。C1/C2 仍未完成：候选、偏好、Explore 分阶段交付、签名 envelope
+迁移，以及可比验收成果和完整成本仍须分别验证。
+
+### C1 wire 布局建议
+
+目标是吸收 quota packet 的必要信息量优势与 TurnEnvelope 的效率优势，一起替换
+二者。“完整”指必要语义完整，不表示今天 packet 中所有重复诊断都永久内联。下述
+保留根路径的无损候选只是迁移对照，用于在消费者迁移时发现遗漏与引用断裂；给它改名
+或转发全部旧字段，均不能满足最终设计。
+
+逐字段、逐条指令盘点所属规则与实际消费者。在依赖它的决策之前，必须具备当前任务、
+原需求及修订、相关证据、权限、必读、执行/停止条件和原结算义务。通过 typed owner
+识别并消除已证实的重复表达与无关诊断噪声。稳定材料只有在保留证据已验证，或来源
+可解析且绑定完整性、读取顺序明确时，才可引用或差分交付；缺失上下文须先恢复再执行
+依赖工作。引用本身不证明模型收到了约束。不能凭正文启发式把未知字段当成可选或静默删除。
+
+在同一规范契约内吸收 envelope 的有效特性：清晰的执行身份与动作组织、单一机器
+binding、减少重复指令、有界交付与可靠详情/恢复。Full/delta/detail 是同一实例的
+编码，不是永久并存的不同语义视图。原始来源证据保留在既有 owner，不再输出第二份
+可执行 packet。最终布局可在引用映射、消费者迁移与实测收益成立时调整；保留根路径
+不是不可更改的产品约束。
+
+| 来源或关注点 | 候选映射与资格要求 |
+| --- | --- |
+| 迁移中的当前 decision 字段 | 无损对照保留路径和值；最终映射前枚举各模式，区分必要语义、已证实重复与纯诊断材料，不能凭某次 packet 推断可选性。 |
+| Work context、必读与结算 | 保留既有 `interaction_contract` 路径与 owner。现有根相对引用保持含义；有意搬迁须显式迁移引用与 reader，不能按模式改写正文或命令字符串。 |
+| Host-operation binding | 从真实调用方 execution context 组合，验证与源权限一致；binding 冲突时拒绝，不能选择方便的表示。 |
+| 内容与传输完整性 | 对整个语义实例作完整性承诺，独立于原紧凑 action digest。精确 capture 字节校验和原结算身份仍分别检查；更换传输编码不创建新 effect。 |
+| 完整 capture 与 Progressive 视图 | 区分规范 `projection.json` 与派生 `required-context.json`/wire 视图，盘点精确根路径、版本、digest 和指针映射；先保存完整恢复源，再交付呈现，仅通过可用且获授权 reader 引用。 |
+| 文件复用、交付覆盖与 retention | 分别盘点既有 typed owner 及证据边界。提议的 `confirmed_read_sections`/派生 `consumed_pointers` 只表示观察到的覆盖，不是产物重建证明、理解或文件 Delta 全读前置。 |
+| 未读发现 | 将提议 `unread_context_index` 映射到当前完整 capture 的指针、版本和来源/读取义务，包括未变的未确认材料；变化/未知映射重新绑定，保留显式不可用状态和权限检查。 |
+| 历史回执与 reader | 未结工作按记录版本解码。临时内部 adapter 可以服务既有效果解释器，但不能成为第二份输出契约，也不能用紧凑副本替代模型必需输入。 |
+
+一个合成布局探针使用真实隔离 File/SQLite quota capture 和既有 TypeScript context
+codec。保留源路径时可使用 warm delta；将全部事实搬至新 `facts` key、同时沿用旧
+`quota_packet` surface 时，以 `delta_not_smaller` 回退 full。两种布局均精确重建，
+epoch 变化均要求 full。Retention 为合成声明；这衡量 codec 行为，不证明宿主观察、
+模型理解或成果/成本收益。它排除的是**沿用旧 surface 却未映射的根路径搬迁**，不是
+一般性的嵌套布局。若映射与消费者收益足以抵偿迁移成本，仍可设计嵌套布局。
+
+因此 C1/C2 须随 wire 迁移显式版本化 context surface 及其 fresh/reuse 路径，不能
+改名冒用旧 surface 或凭 Turn 身份继承基线。迁移时先保存兼容的完整来源，面向模型
+视图可以已使用 Progressive；复用须具备上文相应的文件产物或 retained-model 证明。
+资格覆盖旧 action 投影之外的字段、基线缺失、
+session/epoch 变化和同 capture 恢复。这里消除了具体布局风险；下一步仍是共享 writer
+与最终消费者替换，不能再建设一个布局框架，也不能据此宣布 C1 交付。
+
+尚未完成的实现候选 [#7430](https://github.com/loopx-project/loopx/pull/7430) 已在既有
+TypeScript owner 中、quota 与原生 Turn 捕获之前组合完整来源，并传入实际 Codex
+stdin。隔离 File/SQLite 的真实 CLI 加合成可执行程序覆盖来源完整性、失败 attempt
+恢复与一次结算。这推进了两个 writer 和最终输入替换，尚未取得 C1 切换资格。
+候选现已通过规范 CLI channel 路由能力重入，并在完整契约的 Codex 输入中保留原始
+hash 绑定的 review/writeback reader。合成 File/SQLite 执行验证了新 obligation 绑定
+和原 Todo 绑定 replan 的材料读取。原生启动现只从已记录的结算身份取得唯一因果
+绑定，观察到的语义 replan obligation 不得替换原 Todo 绑定。源 quota 与健康拒绝
+仍阻止宿主启动。Release fixture 现只导入一次最终来源；这些可执行检查不代表真实
+模型或已安装宿主验收。结构化宿主 renderer 现与 Codex 共享完整输入传输及原 hash
+绑定的材料读取器。实际隔离 File/SQLite Turn→DSH runner 接收同一捕获来源；历史
+请求 prompt 正文保持精确一致。结构化 DSH 仍使用 Todo 范围的 session：只有
+obligation 的 replan 在派发前被拒绝，不伪造 Todo 绑定。完整来源有意保留未激活能力的
+配置和诊断事实；这些事实不会激活 recall 指令或 reflection 结果字段。这是已披露的
+展示变化，激活边界与历史等价分开验证。
+Markdown quota 入口现渲染同一份完整契约，不再另外挑选事实子集。真实 File/SQLite
+CLI 捕获验证普通入口与原 envelope flag 均保留全部字段和指令，JSON 类型与任意
+来源正文经过渲染后不丢失。外部 worker 的 File/SQLite 准入、未决 attempt 恢复和
+重启检查已通过完整 producer 输出；但不透明 shell wake 仍不能证明该原始契约已
+交付 executor 模型。
+真实 benchmark checkpoint preflight 已验证 File/SQLite、replan/非 replan 及
+context delivery 开关组合下的完整来源相等；可选 full recovery 保留同一来源，初始
+准入只有一次，reader 不写状态。这只证明契约传到 checkpoint 的模型输入文件，
+不代表原生 session 捕获或 benchmark/模型成果。此前只要外层 source hash 相符，
+`replan-view` 就会接受不支持的版本或无效的内部绑定；现在复用既有完整契约 validator，
+未版本化的历史读取保留原解码器。
+successor 写入指引现已在完整 capture 前绑定到已决定的 Turn，复用历史 staged
+读取的同一格式化 owner。完整契约包含原 Turn/Goal 绑定，以及结束前完成创建回执
+所返原结算、不得执行 successor 的义务；后续现代材料读取不再追加第二次绑定。
+真实 File/SQLite 的 App heartbeat 和 generic CLI 测试从该内联契约创建 successor，
+拒绝过早 spend，原身份只结算一次并保持 successor open，不依赖再次 guard 或
+staged reader。这改变了完整输入的 successor 指引；未版本化历史读取保持原行为。
+仅结算、capability intent、未绑定和 context 不匹配的输入保留原写入指引。
+checkpoint 的旧 reader 测试本身不能证明这条生命周期。剩余材料 reader 退役及
+其他 C1 消费者不能为满足历史断言而恢复第二份精简可执行事实视图。
+完整契约边界现复用既有 decision/frontier 词表，在 capture 前与后续读取时拒绝未知、
+空值或类型错误的根执行 action；hash 合法不能证明消费者理解未知执行语义。可选证据
+仍完整保留，包括陌生版本和形似 action 的字段名；未版本化历史 action 路由不变。
+这只验证根 action 边界，不代表所有必需语义字段均已验收。真实 File/SQLite 原生 CLI
+的 producer 故障在 capture、派发与 spend 前被拒绝；前一候选会到达更晚的启动拒绝，
+这些探针不证明此前存在无保护执行。Selected-work 测试现读取
+完整 interaction context，并通过真实原生 `turn plan` 入口验证宿主输入。真实
+File/SQLite 检查保留完整任务正文、规范 note、作用域 gate、需求新鲜读取及来源丢失
+恢复，不把 App capture 换绑到原生宿主。此前六项旧根布局断言失败仍作为历史失败
+保留；它们后续的语义检查现在已实际执行。
+此前六项 staged-reader 失败作为历史证据保留。完整 composer 现于 capture 前
+复用 Explore 既有可用性修正：已证明没有 Todo 的 pure replan 不再展示必须绑定
+Todo 的结果附件写法。证据、独立图命令与全部工作前义务保留；陌生/自定义指令及
+歧义绑定保持原文。有 Todo 的可用附件写法仍完整内联。这是可用性修正，不改变
+权限，也不新增精简事实视图。真实 File/SQLite 原生宿主输入覆盖两种绑定。
+Staged 测试现消费完整 CLI 输入，并对同一不可变 capture 运行历史材料 reader
+codec，覆盖恶意 PATH、不可用 registry、身份/验收篡改及实际 writer。测试比较
+全部 successor 绑定指令，不再排除完整输入已拥有的字段。附件拒绝 fixture 提供
+合法、显式的 finding status，确保实际到达缺少 Todo 的身份门。23 项 staged
+检查与四项原生宿主用例通过；这些相互重叠的范围不能证明全部消费者退役或打包
+宿主资格。
+原生 context fixture 现将两种 CLI 写法都绑定到 `complete_turn`，并将重建后的
+全部事实与原始 capture 比较。首次四项失败源于恢复 oracle 仍使用旧 surface；
+Unix rendezvous 检查此前只比较内容，允许 full 回退掩盖同一错配。修正后要求
+原 target 和实际 delta 模式。十项用例通过真实 Codex exec/app-server/code-mode
+及 worker resume，使用隔离 SQLite 与确定性本地回环响应，覆盖压缩、进程恢复、
+历史文件替换和未合格 replay profile。未调用付费模型或启动 benchmark 实验。
+当前完整 quota-settlement CLI 模块 158 项通过，包含历史 cache parity 用例；
+此前间歇性错配的原因尚未证明，不能改写为历史通过。
+File/SQLite context→DSH 子进程检查现使用完整 capture 和生产 request builder，
+不再把当前 CLI 响应当作旧 action projection。普通 capability 开/关输入保留全部
+来源事实；已绑定 replan 使用生产 capture binder，并执行实际交付的原证据 reader。
+来源事实、schema 版本或 replan 义务被修改时，在 runner 接缝前拒绝；显式历史引用
+reader 覆盖仍保留。八项聚焦用例通过，使用注入的记录 runner，未调用真实 DSH 模型；
+本次测试迁移没有修改 runtime 代码。
+完整契约边界现进一步复用既有 interaction decoder，校验必需版本、channel 类型、
+通知策略和执行一致性。四种非法语义原先能通过组合；现在即使 producer 提供正确
+完整性哈希也会拒绝。保留原对象及未知可选事实，不用 decoder 规范化输出替换原文。
+File/SQLite 原生输入检查确认不支持的内层版本在 Codex prompt 执行或 DSH runner
+加载前拒绝，且不扣额。完整契约/context/DSH/stdio 集合 352 项通过，TypeScript
+检查及聚焦 lint 通过。这只证明上述交互语义，不代表所有必需字段或打包宿主已验收。
+剩余 cache 一致性调查、其他旧 reader 断言、分阶段指令等价和实际 optional/external
+消费者、版本准入及打包宿主连续性仍未完成。缺少显式原生 runtime 的 operation SDK
+检查属于未测，不能算资格。默认 writer 变更尚未交付；PR 因作者实现未完而保持
+Draft，不是仅等待评审。尚无模型或成本收益证据。历史 effect 解码只是临时迁移，
+不得成为第二份永久可执行视图。
+
+### C1 消费链替换与切换单元
+
+切换单元是一个受支持入口**及其下游消费者**，不是一个输出开关。对
+`99921829f2c5` 的源码核对确认以下活跃接缝。这补充前述基线审计；它是迁移设计，
+不表示这些路径已经改变。
+
+| 活跃接缝 | 具体替换与保留的 owner |
+| --- | --- |
+| `quota.py::_emit_quota_result` / `_project_quota_cli_payload` | 在 capture 前组合完整契约，替换 ordinary/envelope 执行格式分支。准入、capability hook、capture IO 与 host poll 回执保留原 owner。诊断 status 视图不是可执行契约。 |
+| `turn.py` 的 `build_fresh_turn_decision_owner().resolve()` 之后 | 携带实际 scheduler execution context 调用同一组合 owner。此入口直接调用 `build_turn_envelope`；仅修改 quota CLI emission 不会迁移 Turn。保留 Turn plan、journal 和回执执行器。 |
+| `heartbeat/task_body.py::render_thin_heartbeat_task_body` | 用统一契约读取指令替换 `captured_envelope` 指令分支，保留精确 selection/reentry transport、通知独立性、必读与原结算身份。保存的 bootstrap 仍在唤醒时解析当前指令。 |
+| `turn_driver/codex_cli.py::_prompt` 与 `host_candidate.py::extract_turn_authority` / `render_prompt` | 在实际 prompt 边界替换格式特定输入。当前普通 Codex 接收 envelope，分阶段 replan 使用提取的 authority，结构化 host 也使用提取的 authority。共享源字节或签名不能证明这些最终输入保留相同义务。保留 provider 结果编码与外层 effect 归属。 |
+| `turn_driver/decision_capture.py` 与 `cli_commands/quota_capture.py` | 复用不可变 capture、校验读取器和 full/delta 交付。首次交付和保存后恢复必须重建同一契约；不能仅因 Turn 身份相同，就把某投影的 continuity baseline 用于另一投影。 |
+| `benchmark/runtime/worker.py`、`benchmark/runtime/sessions.py` 与 `scripts/external_scheduler_worker.py` | 迁移它们实际调用的产品入口。保留评估配置与外层唤醒归属，不新增 benchmark 专用转换，也不把 managed-host 测试算作 attached-host 验收。 |
+
+替换任一接缝前，实现 PR 记录源路径、字段或指令条款、当前 reader、目标 owner、表示、
+恢复与退役条件。字段搬迁须包含引用解析；删除诊断须证明其中不含动作、权限、必读或
+验收义务。未知数据不得静默消失；未知的必需执行语义也不能靠转发 JSON 就变安全，
+相关操作须保持不可用，直到兼容消费者能够理解。不能用子串匹配分类义务。
+
+使用**一次明确的版本迁移**，不在每次唤醒自动协商格式。已迁移 binding 的新准入要求
+组合、交付和消费 reader 兼容。不支持的消费者在 dispatch 前收到可操作的不可用结果，
+不能因此创建第二个活跃 writer。已准入工作继续使用记录的版本和原回执；在这些工作及
+受支持恢复窗口核清前保留历史 decoder。回退同样区分未结工作与新准入。版本迁移不能
+把保存的 prompt、journal 或源 hash 改写成仿佛一直使用新契约。
+
+C1 首个 PR 必须覆盖上述两个生产组合调用点，并交付至少一条从生产端到最终输入的
+完整旅程，同时明确剩余 reader。这个有界切片通过资格，不代表可向未验收 host 开启
+新 writer，也不关闭 C1。最终切换须在全部受支持 reader 验收后删除活跃格式选择。
+临时 decoder 有具名 caller 与退出条件，不是面向用户的兼容视图。
+
+对 normal、selection、replan、wait、recovery 和 capability-off 的每个 fixture，
+在**三个边界**核对独立编写的义务：组合契约、重建交付、最终模型输入及必需材料读取。
+包含旧 action signature 未覆盖的源变化、必需来源缺失、不兼容消费者和结算响应丢失。
+仅重建相等会漏掉 prompt 层丢义务；仅 prompt 完整会漏掉过期权限或重复扣额。
+这些是集成要求，不授权运行模型或启动实验。
+
+1. 盘点实际 producer、reader、writer、已保存 prompt、capture 和外部集成。把每个旧
+ 字段与正文义务映射到保留的 owner/字段、权威派生或明确批准的删除。“事实相同”的
+ 总括声明不够；保留原失败 fixture。
+2. 通过真实 quota、thin-heartbeat、Turn 入口验收统一契约的单会话执行。每个 binding
+ 只切一个 writer；旧 reader 是绑定版本的显式迁移 adapter，列出真实调用方与删除
+ 条件，不能成为长期产品视图。
+3. 加入按角色区分的 session、共享生命周期复用及 opt-in 双会话 profile，复用既有
+ same-session/native-resume 和 effect recovery 代码。
+4. Benchmark worker 与打包 App heartbeat 采用同一产品 profile。各 host 分别证明
+ 观察、停止和恢复；CLI 测试或模型模拟不能证明已安装 App 合格。
+5. 最后一个受支持活跃 reader 迁移后，删除旧 producer、格式选择开关、重复 renderer
+ 与双格式测试。只为受支持历史回执 replay 保留版本 decoder。终态验收要求只发出一份
+ 契约，不再选择 quota 或 Turn packet 格式。
+
+回退先关闭受影响 profile 的新准入，drain/中断 attempt，核对回执，再在下次准入工作
+恢复先前合格 profile。不能静默替换 native session 或重解释 pending 回执。删除字段/
+decoder 前证明 export、旧版本 readback 与降级行为；满足受支持保留/升级边界前保留旧
+reader。本文不单独授权破坏性迁移。
+
+### C1 基线边界与复用盘点
+
+基线是**原路径中调用者实际收到的 quota 交付**，不是内部原始 decision。
+`cli_commands/quota.py` 的原 emitter 先捕获 source；有 capture 时按条件应用
+`replan_cli_view`，再应用 `compact_quota_should_run_cli_payload`，随后原生上下文
+交付还有 full/delta 传输。两组须记录精确版本、host flags、capture 是否可用及 detail
+选项。用更大的内部 source 对比紧凑候选会夸大节省；只用延后读取的首包对比完整候选，
+则会漏算基线的后续成本。
+
+现有路径已包含值得复用的效率行为。C1 应把已合格的语义吸收到共享 TypeScript
+composition/context owner，再退役旧的 caller-specific producer。不能直接套用整个旧
+compactor：精确共享、省略和延后读取的信息与失败后果各不相同。
+
+| 现有信息／变换 | 融合处理与决定性检查 |
+| --- | --- |
+| 已选工作、原始要求、验收、证据、权限及停止条件 | 依赖它们的决策前可用。保留不同 revision 和矛盾证据；lane 标签或 action signature 均不能证明完整性。 |
+| 相同验收副本、嵌套 vision audit、authoring 和可选指导 | 在更小时优先使用契约内一份完整 owner 加精确引用。比较 JSON 类型及每条义务；不同或缺失 owner 时分别保留。不增加补读或决策权。已有 projection 测试只提供特征验证，不代表新消费者已合格。 |
+| 有限 Todo lanes、缩短的建议、省略的边界／历史项 | 视为主动省略，而非无损去重。保留完整性／计数事实和同 capture 恢复；证明被省略项不影响当前决策，或先加载再决策。旧显示上限不能自动变成语义上限。 |
+| 捕获后的 replan review、验收详情和 writeback reader | 区分决策事实与后续 authoring 格式，同时保留原身份和全部必要含义。读取绑定同一 capture；计入每个必需阶段、错误和恢复。引用缺失／过期不能重新 guard 或授权工作。 |
+| Full/delta/resume 交付 | 在 composition 后复用既有 continuity owner。行动前验证精确语义重建与必要材料可用；计入冷回退及丢失基线的恢复。 |
+| Scheduler、准入与结算身份 | Capture 前只有一份权威实例；传输保留真实 host owner、原 Turn 与一次性 effects。重复表示不构成削弱检查的理由。 |
+
+单独后移验收共享不自动构成有价值的前置切片。以主线
+`99cfa3ac559bfa237f04f36fb7e926672fea44b2` 为基线的 source-level 受控替换，
+只把该规则从本地 CLI compactor 移到已有 `reference_context` 调用。同一份含 100 条
+不同要求的合成 fixture 中，序列化投影输入从 102,680 增至 344,010 字节，调用者可见
+输出仍为相同的 102,189 字节。普通路径仍调用一次；全部 detail 开启时由本地共享变为
+一次请求。这些是投影参数测量，不是带协议包装的流量、延迟、模型计费或完整 C1 对照。
+保留此负结果，不能宣称净效率收益。
+
+兼容 owner 也为验收、Vision audit 和 replan authoring 共享复用一份本地 JSON 序列化
+身份。不能用 Python 普通值相等，把不同布尔／数值、整数／浮点表示或带符号零替换成
+另一条观测的别名。完全相同的副本仍共享同一响应内的 owner，包括键顺序不同的情况；
+不同事实保留全文。这修复来源保真，不增加投影 RPC；不代表统一 writer、最终消费者
+或相对原 quota 的成果／完整成本收益已经合格。
+
+先在当前兼容 owner 修复被迁移的验收引用，不引入上述额外传输。已有别名只跟随本次
+投影实际迁移的内联 owner，包括先访问别名、后迁移 owner 的情况。保留完整值、原始
+数值类型、carrier 顺序和现有大小判断；不推断任意引用链，不重写已存 capture。
+完整 C1 composition 应在持有来源的边界吸收该规则，并随调用方退役 Python 兼容
+算法，不能把所有验收副本反复传过另一条 bridge。Writer／consumer 切换和原 quota
+成果／完整成本门继续保持开放。
+
+候选 `895f38fc5` 的固定 source 合成 replan 审计说明了边界的影响。关闭 stride 且不做
+capture 分阶段时，原始 source 为 21,461 个紧凑 UTF-8 JSON 字节，原 quota CLI
+projection 为 20,543，完整候选为 21,738：**相对 CLI 增加 5.82%**，相对原始 source
+则是 1.29%。启用 capture 分阶段后，entry/review/writeback 合计 21,882 字节，候选
+为 21,821。启用 `evidence_conditioned_v1` 时，分阶段合计 28,558，候选为 33,368。
+这里使用既有合成 replan fixture、生产 projection/read 函数与合成 capture 路由；
+不是实际模型轨迹或安装宿主实验。追加的验收／Explore 读取、实际请求包装、缓存行为
+及成果差异均未测。切换 legacy receipt 得到相同数据，不增加独立 workload。这些数字
+不支持净收益结论。
+
+下一实施切片应先在 composition、reader 和 recovery 中验证同契约精确共享，再用上述
+可比负载评估延后详情的取舍。冷启动与分阶段总量分别保留，保留负结果，不能靠删除独有
+指令达到字节目标。
+
+同时报告字段/条款 diff 及其决策后果、实际模型输入、cached/uncached tokens、追加
+读取/往返、重建、延迟、失败/重试、验证与人工介入。首包更小但总补读更多，可能是负向。
+只有必要语义保留且同等验收成果的完整成本降低，或可比预算下验收成果改善，才判正向。
+效果混合则报告取舍；只有传输通过或成果未测时结论仍不确定。按既有测量合同在可比实验
+前确定数值标准，不凭空规定压缩比例。C1 切换须完成这个 quota 基线对照，不能仅凭
+serializer 或字节减少结清。
+
+使用[既有测量模型](../long-horizon-harness-benchmark-research-program-v0.md#6-measurement-model)。
+计入两个会话的输入/输出/cached tokens、工具及材料读取、planning/replan/recovery、
+墙钟时间、验证、人工注意力和 provider 成本；未知用量不是零。持久化因果归因，转发
+产物时不重复计算成本。比较可比预算下的已接受成果，不能只看 replan 次数或 executor
+速度。另行授权实验前冻结标准，本文不预设胜出方案。
+
+在后续双会话对照中，除 executor 工作，还要归因 controller 推理及全部交接／材料、
+验证与恢复成本。收支平衡问题是：在保留可比验收成果时，这些**新增完整成本**能否被
+避免的控制／记账、重复执行或人工介入所抵消。即使两会话读同一产物，也按实际重复
+模型消费计量；转发同一用量回执不能把该回执重复计费。报告不同 workload 的取舍和
+账单／缓存覆盖未知。本文不规定通用开销阈值、压缩比例或每条消息 token 上限；此对照
+不替代前置的原 quota 与统一单会话验收。
diff --git a/docs/architecture/rfcs/loopx-overall-roadmap-v0.md b/docs/architecture/rfcs/loopx-overall-roadmap-v0.md
index c8f7b41181..7f3597129b 100644
--- a/docs/architecture/rfcs/loopx-overall-roadmap-v0.md
+++ b/docs/architecture/rfcs/loopx-overall-roadmap-v0.md
@@ -187,8 +187,8 @@ format choices. Its [two-layer delivery design](controller-executor-unified-cont
targets cross-host Progressive by default, independent Delta auto only on
qualified hosts, and unread-material discovery from the current complete capture;
explicit off and versioned migration remain protected. The optional
-controller model alone talks to Core; the executor receives natural-language
-work and materials, while existing host/Core owners retain identity, permissions,
+controller model owns its unit’s model-facing Core work control and settlement;
+the executor receives natural-language work and materials, while existing host/Core owners retain identity, permissions,
recovery and settlement. Session roles, execution modes, wake sources and
benchmark arms remain separate axes. This is design direction, not shipped
behavior or evidence of lower cost.
@@ -253,6 +253,27 @@ records already-shared code and distinct lifecycles that must not be merged by
appearance. Packages are claimable slices, not a fixed PR count or new controller
prerequisites; runtime delivery and qualification remain open.
+The [Router–Controller–Worker extension](controller-executor-unified-contract-v0.md#router-controller-worker)
+makes the steward a cross-Agent router while each controller + worker retains one
+Agent binding unit. A long worker operation must not block controller input from
+the user/router; existing Core, request, session, queue and return owners retain
+authority. Authorized router request operations cannot settle unit work or copy
+budgets. [Attention and safe preemption](controller-executor-unified-contract-v0.md#controller-attention-and-preemption)
+prioritize current user interaction, then ready [controller–worker main-loop work](controller-executor-unified-contract-v0.md#controller-worker-main-loop),
+including ordinary result assessment and feedback, not only blocked-worker help.
+Without another user message, useful admitted work continues through original
+settlement and fresh admission; input handling returns to that loop rather than
+automatically resuming a report. Background reports yield while original-effect
+recovery and one control writer remain intact. The [current source audit](controller-executor-unified-contract-v0.md#current-delivery-audit)
+separates shared managed operations, multi-recipient requests and revisions from
+the missing role pair and asynchronous journey. The [delivery slices](controller-executor-unified-contract-v0.md#delivery-path-from-current-state)
+reuse C1–C9: one autonomous unit loop → busy-time interaction/correction/Stop → router adoption
+of two units → outcome/cost qualification and retirement. These are selected-profile
+dependencies, not fixed global priority or additional router merge gates on C1.
+Existing correctness repairs and simplification with real callers can land
+independently; no new scheduler, message bus or task store. Full schema cutover and
+dual sessions remain undelivered, with unchanged defaults.
+
### Current priorities after research and acceptance integration
This checkpoint is pinned to main `5550e91bab` (2026-10-23). It reconciles
@@ -524,7 +545,6 @@ authority and privacy checks; optimize repeated reads only with equivalent
positive, negative, retry, and stale-generation outcomes. A fast sink no-op
is not evidence that long-history status and quota admission meet G4 SLOs.
-
## 4. Every RFC: Ownership and Next Step
This maps the primary RFC inventory through the date in the header, counting
@@ -1007,7 +1027,6 @@ configuration tests qualify this slice. Existing installed settings and immutabl
old failures are retained; installed activation and effect-aware recovery of an
original timed-out request remain separate acceptance, not inferred replay.
-
**Bound-conversation status presentation.** The shared display renderer leads
with canonical execution/recovery state, project and queue/permission facts;
the Lark adapter reserves full commands and diagnostics for help, retaining a
@@ -1361,7 +1380,7 @@ bytes under shared locks; Python retains filesystem transport. Regular retained
lease history remains witnessed without granting a live lease. This closes a
bounded source-inventory gap; complete cold-source import, original-operation
recovery, packaged App adoption and the reversible developer trial remain on
-the [existing migration/release path](../../reference/local-authority-provider-selection.md#proposed-compatibility-cutoff-and-release-sequence).
+the [existing migration/release path](../../reference/local-authority-provider-selection.md#20-compatibility-cutoff-and-release-sequence).
审核源准入拒绝不支持的租约 JSON 文件名、非普通文件和链接子目录，不再静默漏读
或跟随链接。既有 TS coordination owner 在共享锁内核对原始字节；Python 保留
diff --git a/docs/architecture/rfcs/loopx-overall-roadmap-v0.zh-CN.md b/docs/architecture/rfcs/loopx-overall-roadmap-v0.zh-CN.md
index 09d9dfd877..3d2a32c399 100644
--- a/docs/architecture/rfcs/loopx-overall-roadmap-v0.zh-CN.md
+++ b/docs/architecture/rfcs/loopx-overall-roadmap-v0.zh-CN.md
@@ -143,8 +143,8 @@ assessment 中有证据绑定的研究综合分析接入指标 → 汇报 →
S2/S4/S6/S7/S11：用一份受治理工作 schema 替代 quota/Turn packet 格式选择。
[双层交付设计](controller-executor-unified-contract-v0.zh-CN.md#差分上下文)以跨 Host 默认
Progressive、仅已资格化 Host 独立 Delta auto，以及当前完整 capture 的未读发现为目标；
-保留显式 off 与分版本迁移。可选 controller 模型独自对接 Core，executor 接收自然语言工作
-和材料；身份、权限、恢复、结算仍归既有 host/Core owner。Session role、执行模式、
+保留显式 off 与分版本迁移。可选 controller 模型负责该单元的 Core 工作控制与结算；
+executor 接收自然语言工作和材料；身份、权限、恢复、结算仍归既有 host/Core owner。Session role、执行模式、
唤醒来源和 benchmark 评估组保持正交。这是设计方向，不是已交付行为或成本收益证据。
Controller 会话的[智能中介作用](controller-executor-unified-contract-v0.zh-CN.md#controller-的智能与语义压缩)
@@ -192,6 +192,23 @@ worker/settlement adapter 和有条件的旧路径退役。从全局成果与实
因外形相似就合并的不同生命周期。工作包是可认领切片，不是固定 PR 数量或 controller
新前置条件；runtime 交付与资格仍未完成。
+[Router—Controller—Worker 扩展](controller-executor-unified-contract-v0.zh-CN.md#router-controller-worker)
+将管家定位为跨 Agent router，每个 controller + worker 沿用一个 Agent 绑定单元。
+Worker 长操作不能阻塞 controller 处理用户/router 输入；既有 Core、请求、会话、
+队列与返回 owner 保留 authority。Router 可用授权请求操作，不能替单元结算或复制预算。
+[注意力与安全插队](controller-executor-unified-contract-v0.zh-CN.md#controller-attention-and-preemption)
+优先当前用户交互，再处理已就绪的 [controller—worker 主循环工作](controller-executor-unified-contract-v0.zh-CN.md#controller-worker-main-loop)，
+包括普通结果评估与反馈，不只阻塞求助。没有用户新消息时，有用的已准入工作仍经原结算与
+新准入持续推进；处理完输入返回这个循环，不默认恢复汇报。后台汇报可让出，原 effect
+对账与单一控制写入方仍保留。
+[当前源码核对](controller-executor-unified-contract-v0.zh-CN.md#current-delivery-audit)区分
+已共享 managed-operation、多接收方与 revision 机制，以及仍缺的双角色绑定/异步旅程。
+[依赖与交付切片](controller-executor-unified-contract-v0.zh-CN.md#delivery-path-from-current-state)
+复用 C1–C9：一个自主单元循环 → 忙时交互/纠偏/Stop → 两单元 router 采用 → 成果/成本与退役。
+这是所选 profile 的依赖，不是全局固定优先级，也不向在途 C1 追加 router 合入门。
+现有正确性修复与有真实 caller 的精简可独立推进；不新建 scheduler、消息总线或任务库。
+完整 schema cutover 与双会话尚未交付，默认仍不变。
+
### 研究与验收集成后的当前优先级
本检查点固定在 main `5550e91bab`（2026-10-23），核对公共源码交付，不公布私有实验
@@ -393,7 +410,6 @@ Muse 设计页在浏览器超时，其文章通过网页检索读取。本次调
不预先发明未经测量的性能数字。每个实验/试点开始前，由对应 owner 固定目标阈值、基线、预算、停止条件与证据范围；结果出炉后改变阈值应作为新实验。G4 correctness 要求无重复受保护效果和过期/越权提交，性能/成本阈值另行测量资格化。
-
## 4. 全部 RFC 的落位与下一步
下表覆盖 header 日期所示的主 RFC inventory，中英镜像合并计数。架构状态仍使用
@@ -748,7 +764,6 @@ Goal 成果页可打开正文；原管家对话仅在已确认团队计划的回
保留安装态既有设置及不可变旧失败；实际启用与核对效果后的原超时请求恢复
仍是独立验收，不据此推断已重放。
-
**S1/S5 注意力 checkpoint。** 本地管家/Goal Turn 无须 Lark 连接，即收到 canonical
阻塞与具体用户请求。共用 TS 读模型合成同一 Todo 的阻塞/决策；正文 adapter 和
阻塞收集服务本地与外部投递。这闭合 Turn preparation 的证据缺口；已有外发使用
@@ -758,7 +773,6 @@ Goal 成果页可打开正文；原管家对话仅在已确认团队计划的回
独立授权的 sink 投递。宣称自动智能通知前，在原打包对话验收无 Channel 的阻塞、
安全回退、用户决定与恢复旅程。
-
- **Owner：** 管家 RFC M2/M3；从已有 `manager_context` request/tracking/return 迁移到单一 typed collaboration 事务，纳入 #4094 adapter。
- **交付：** 交接保存目的、决策、约束、证据引用和期望回报；receiver 读取后自行 adopt/defer/reject/replan。用独立事实表示 accepted work、result committed、answer delivered；从已有 outbox 自动回传。
- **退出：** manager→worker 和 worker→worker 两个真实 caller，补充消息、来源会话消失、超长答案、重复回调、发送成功但 ACK 丢失及传输重启；同一结果在 CLI、packaged frontend、Lark 回读一致且受众隔离。普通已授权工作不增加第二次人工确认。